0

This problem usually occurs with servers, but the question itself is about network.

When I have a gateway with 10.1.1.1 and an interface with /24 network, the network routes are automatically installed by the os as follows:

0.0.0.0/0 via 10.1.1.1 dev eno1 src 10.1.1.10
10.1.1.0/24 dev eno1

And if I have a packet destined to 10.1.1.20 from local, it doesn't send the packet to its gateway 10.1.1.1. Instead, it looks up an arp table for 10.1.1.20 and writes a destination address for 10.1.1.20 in its frame.

However, if there's a static host route to 10.1.1.20 with the next hop 10.1.1.1 in the route table (see below), it seems to look up an arp table for 10.1.1.1 and write a destination address for 10.1.1.1 in its frame.

10.1.1.20/32 via 10.1.1.1 dev eno1 src 10.1.1.10

So what's going on here?

Why does it look up an arp entry for a destination host when the route table has only network address, but it looks up an arp entry for the next hop when the route table has a host address?

2 Answers 2

5

Why does it look up an arp entry for a destination host when the route table has only network address, but it looks up an arp entry for the next hop when the route table has a host address?

10.1.1.0/24 dev eno1 
10.1.1.20/32 via 10.1.1.1 dev eno1 src 10.1.1.10

Note how the route to 10.1.1.0/24 (the upper one) doesn't have a gateway ("via xxx") set, but the second one does. Having no gateway means the destination must be directly accessible, on the given device ("on-link"). For IPv4 and Ethernet, that means making ARP queries and sending the packets directly to the destination host's Ethernet address.

With the gateway set, the final destination is (supposedly) not available directly on the link, so the packets are sent through the gateway. It's the gateway's address that's looked up for ARP queries, and its Ethernet address used as the destination of the frame.

This isn't related to host vs. network routes, as you could have a route like this:

10.1.2.0/24 via 10.1.1.99 dev eno1 src 10.1.1.10

i.e. a network route through a gateway. (Similar to the default route you already had there, but anyway.)

Similarly you could have an on-link route (without a gw) to a host:

10.1.1.20/32 dev eno1
1
  • Aha, so the os assumes that the destination is on L2 link if the best route to it on the route table has no next hop address or gateway set. That's why the connected routes are never set with the next hop address. Now I get it. Thank you.
    – saba
    Nov 29, 2022 at 12:04
1

When I have a gateway with 10.1.1.1 ...

You are referring to a default gateway.

if there's a static host route to 10.1.1.20 with the next hop 10.1.1.1 in the route table, it seems to look up an arp table for 10.1.1.1

Correct - a more specific routing table entry (host route means /32) is preferred over a less specific entry (like /24 in that case for the local subnet). More specific means longer prefix, less specific shorter prefix.

Accordingly, the packet is sent to the indicated gateway, with ARP as required. Sent to means the encapsulating frame uses the gateway's MAC address (in a MAC-based network).

The routing table doesn't necessarily need to be optimal or correct. IP takes the entries as they are and whoever puts there takes the responsibility for them to make sense.

10
  • I wasn't asking about the longest prefix match principle. My question is that even though both the host and network routes have the same next hop, why it uses different mac addresses for the same frame. Is this because the subnet in the host route doesn't include the source IP address?
    – saba
    Nov 27, 2022 at 11:16
  • The L2 destination MAC address is the next hop's. With a destination "on link" it's the destination's MAC, otherwise it's the gateway's.
    – Zac67
    Nov 27, 2022 at 12:30
  • I don't understand what you mean by "on link."
    – saba
    Nov 27, 2022 at 15:29
  • I just tested this and found that whatever route it chose whether it be a network route or a host route, if the source IP address is on the same subnet as the chosen route, it tries the MAC address of the dst IP; otherwise it's the default gateway's MAC address.
    – saba
    Nov 27, 2022 at 15:34
  • "On link" means it's on a shared L2 segment and directly reachable from a NIC.
    – Zac67
    Nov 27, 2022 at 15:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.