Routing Traffic

Driving from home to a destination:
- Multiple possible routes
- GPS calculates best path
- Considers: distance, traffic, tolls
- Updates route if traffic jam

Routing:
- Multiple possible network paths
- Router calculates best path
- Considers: hops, bandwidth, delay
- Updates if link fails

Without routing:
Your computer → Only devices on same network

With routing:
Your computer → Anywhere in the world!

The internet is just millions of routers
forwarding packets to their destinations

Your computer (192.168.1.100) → Google (8.8.8.8)

1. Check: Is 8.8.8.8 on my local network?
   Answer: No (different network)
   
2. Send to default gateway (router)
   Gateway: 192.168.1.1
   
3. Router checks routing table
   Best path: Send to ISP router
   
4. ISP router checks its table
   Best path: Send to regional router
   
5. Regional router → Core router → Google
   
6. Google receives packet!

Then reply follows reverse path (or different path)

[Your PC] → [Home Router] → [ISP Router] → [Regional Router]
  .1.100       .1.1            ISP IP          Regional IP
                                                      ↓
[Google] ← [Core Router] ← [Transit Router] ← [Regional Router]
 8.8.8.8
 
Each → represents a routing decision

route -n
# or
ip route show
# or
netstat -r

route print
# or
netstat -r

netstat -r

Destination     Gateway         Genmask         Iface
0.0.0.0         192.168.1.1     0.0.0.0         eth0    (default route)
192.168.1.0     0.0.0.0         255.255.255.0   eth0    (local network)
10.8.0.0        10.8.0.1        255.255.255.0   tun0    (VPN)

Line 1 (Default route):
Destination: 0.0.0.0/0 (anything not matched below)
Gateway: 192.168.1.1 (send to this router)
Interface: eth0

Line 2 (Local network):
Destination: 192.168.1.0/24
Gateway: 0.0.0.0 (directly connected, no gateway needed)
Interface: eth0

Line 3 (VPN):
Destination: 10.8.0.0/24
Gateway: 10.8.0.1
Interface: tun0 (VPN tunnel)

Destination:  Where packets are going
Netmask:      Network size
Gateway:      Next hop router (0.0.0.0 = directly connected)
Interface:    Which network interface to use
Metric:       Cost/preference (lower = better)

1. Receive packet
2. Look at destination IP
3. Check routing table (most specific match wins)
4. Send to next hop via interface
5. Decrement TTL
6. Forward packet

Routing table:
10.0.0.0/8      Gateway A
10.1.0.0/16     Gateway B
10.1.2.0/24     Gateway C
0.0.0.0/0       Gateway D (default)

Packet to 10.1.2.50:
✓ Matches 10.0.0.0/8
✓ Matches 10.1.0.0/16
✓ Matches 10.1.2.0/24 ← Most specific! Use this.
✓ Matches 0.0.0.0/0

Forwards to Gateway C

0.0.0.0/0 or ::/0

Matches everything
Used when no other route matches
"Gateway of last resort"

Example:
All unknown destinations → Internet

# Add route
sudo ip route add 10.0.0.0/24 via 192.168.1.1 dev eth0

# Add default route
sudo ip route add default via 192.168.1.1

# Delete route
sudo ip route del 10.0.0.0/24

# Persistent (Debian/Ubuntu):
# Edit /etc/network/interfaces
auto eth0
iface eth0 inet static
    address 192.168.1.100
    netmask 255.255.255.0
    gateway 192.168.1.1
    # Additional routes
    up ip route add 10.0.0.0/24 via 192.168.1.1

# Add route
route add 10.0.0.0 mask 255.255.255.0 192.168.1.1

# Add persistent route
route -p add 10.0.0.0 mask 255.255.255.0 192.168.1.1

# Delete route
route delete 10.0.0.0

# View routes
route print

# Add route
sudo route add -net 10.0.0.0/24 192.168.1.1

# Delete route
sudo route delete 10.0.0.0/24

✓ Pros:
- Simple
- Predictable
- Low overhead
- Full control

✗ Cons:
- Manual configuration
- Doesn't adapt to failures
- Not scalable (large networks)
- No load balancing

Routers:
1. Exchange routing information
2. Learn about networks
3. Calculate best paths
4. Update routing tables automatically
5. Adapt to changes (link failures)

Characteristics:
- Simple
- Broadcasts routes every 30 seconds
- Slow convergence
- Not scalable
- Legacy (don't use for new networks)

Use case:
- Small networks
- Simplicity needed

router rip
 version 2
 network 192.168.1.0
 network 10.0.0.0
 no auto-summary

Characteristics:
- Fast convergence
- Scalable (large networks)
- Hierarchical (areas)
- More complex
- Industry standard

Use case:
- Enterprise networks
- ISPs
- Fast convergence needed

router ospf 1
 network 192.168.1.0 0.0.0.255 area 0
 network 10.0.0.0 0.255.255.255 area 0

Characteristics:
- Internet backbone protocol
- Policy-based routing
- Very scalable
- Complex
- Between autonomous systems (ASes)

Use case:
- Internet routing
- ISP interconnections
- Large enterprises

router bgp 65000
 neighbor 203.0.113.1 remote-as 65001
 network 192.168.1.0 mask 255.255.255.0

Characteristics:
- Fast convergence
- Low overhead
- Supports VLSM
- Scalable
- Cisco proprietary (historically)

Use case:
- Cisco networks
- Enterprise environments

Protocol    Metric
─────────────────────────────────
RIP         Hop count
OSPF        Cost (bandwidth)
EIGRP       Composite
BGP         Path attributes (policy)

Path A: 3 hops → Metric = 3
Path B: 5 hops → Metric = 5
Best: Path A (fewer hops)

10 Mbps:    Cost = 100,000,000 / 10,000,000 = 10
100 Mbps:   Cost = 100,000,000 / 100,000,000 = 1
1 Gbps:     Cost = 100,000,000 / 1,000,000,000 = 1

Lower cost = faster link = preferred

1. Send packet with TTL=1
   First router: TTL expires, sends "Time Exceeded"
2. Send packet with TTL=2
   Second router: TTL expires, sends "Time Exceeded"
3. Continue until destination reached

# Linux/macOS
traceroute google.com

# Windows
tracert google.com

# With ICMP (Linux, requires root)
sudo traceroute -I google.com

# With TCP on port 80
sudo traceroute -T -p 80 google.com

traceroute to google.com (172.217.14.206), 30 hops max

 1  192.168.1.1 (192.168.1.1)           1.234 ms
 2  10.0.0.1 (10.0.0.1)                 5.678 ms
 3  isp-router.net (203.0.113.1)        10.123 ms
 4  regional.isp.net (203.0.113.50)     15.456 ms
 5  core.isp.net (203.0.113.100)        20.789 ms
 6  google-peer (172.217.14.1)          25.012 ms
 7  google.com (172.217.14.206)         30.345 ms

# Traceroute to map path
traceroute target.com

# Identify routers and firewalls
# Look for:
- Private IPs (behind NAT)
- Firewall routers (* * * = blocked)
- ISP infrastructure

- Inject malicious routes
- Redirect traffic through attacker
- Black hole routing (DoS)
- BGP hijacking (nation-state level)

Specify exact path through network
Bypass firewall by avoiding it
Usually disabled for security

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# Add routes
ip route add 10.0.0.0/24 via 192.168.1.50

# Set up SOCKS proxy
ssh -D 1080 user@compromised_host

# Or use Metasploit autoroute
meterpreter> run autoroute -s 10.0.0.0/24

Attack RIP:
- Send fake RIP advertisements
- Claim best route to network
- Redirect traffic through attacker

Tools: Loki, evil_[protocol]

1. Attacker announces route to victim's IP space
2. Internet believes attacker has shorter path
3. Traffic redirected to attacker
4. Attacker can intercept, modify, or drop

Famous examples:
- Pakistan telecom (YouTube, 2008)
- China Telecom (various incidents)

# Send ICMP redirect
# Host updates routing table
# Attacker becomes default gateway (MITM)

# Usually disabled on modern systems

# Become "router" for victim
arpspoof -i eth0 -t victim_ip gateway_ip
arpspoof -i eth0 -t gateway_ip victim_ip

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# Now all victim's traffic goes through you

# Check default route
ip route show | grep default

# If missing, add:
sudo ip route add default via 192.168.1.1

# Check if route exists
ip route show | grep <network>

# Add route if missing
sudo ip route add 10.0.0.0/24 via 192.168.1.1

Packets go out one path, return via different path
Can cause issues with stateful firewalls

Solution:
- Check routing tables on all devices
- Ensure symmetry if required

Packet bounces between routers infinitely
TTL eventually expires

Detection:
- traceroute shows repeating routers
- High latency
- Packet loss

Fix:
- Correct routing tables
- Check routing protocol configuration

# View routing table
ip route show          # Linux
route print            # Windows

# Test connectivity
ping <destination>

# Trace route
traceroute <destination>    # Linux/macOS
tracert <destination>       # Windows

# View ARP cache (local routing)
arp -a                 # All systems
ip neigh show          # Linux

# Capture routing updates (OSPF, RIP)
sudo tcpdump -i eth0 proto ospf
sudo tcpdump -i eth0 port 520  # RIP

# View routing table
# Linux:
ip route show

# Windows:
route print

# Identify:
# - Default gateway
# - Local networks
# - Any special routes (VPN, etc.)

# Add route to a network (adjust to your setup)
# Linux:
sudo ip route add 10.0.10.0/24 via 192.168.1.1

# Windows:
route add 10.0.10.0 mask 255.255.255.0 192.168.1.1

# Verify:
ip route show | grep 10.0.10.0    # Linux
route print | findstr 10.0.10     # Windows

# Test (if network exists):
ping 10.0.10.1

# Remove route:
sudo ip route del 10.0.10.0/24    # Linux
route delete 10.0.10.0            # Windows

# Traceroute to various destinations
traceroute google.com
traceroute amazon.com
traceroute github.com

# Questions:
# - How many hops?
# - Can you identify your ISP's routers?
# - Where does traffic leave your ISP?
# - Any interesting hostnames?

# Before VPN:
ip route show
traceroute google.com

# Connect to VPN
# After VPN:
ip route show
# Should see new routes via VPN interface (tun0)

traceroute google.com
# Should route through VPN

# Disconnect and observe routes change back

# View routes
ip route show             # Linux
route -n                  # Linux
route print               # Windows
netstat -r                # All systems

# Add static route
ip route add <network> via <gateway>        # Linux
route add <network> mask <netmask> <gateway> # Windows

# Delete route
ip route del <network>    # Linux
route delete <network>    # Windows

# Traceroute
traceroute <host>         # Linux/macOS
tracert <host>            # Windows

# Enable IP forwarding (make Linux a router)
echo 1 > /proc/sys/net/ipv4/ip_forward