netstat -nr shows routing table growing

[Brian McEntire]

I am not running routed or any router discovery daemons on my HP-UX 10.20 system.

Why then is the netstat -nr routing table growning at a slow but constant rate? (Several per hour, it gets to be in the 1000s!)

Is there a way to avoid this?

* FYI, this may be a silly question to ask, but is there a search feature for these forums? That would be nice! I'm sure my 1st Q has come up before.

Thanks!

[John Poff]

Hi Brian,

For the search feature, just look on the left side of the screen under "IT Resource Center" and the first tab listed is "Search". Put your cursor on it and click it, and it will take you to a search window where you can enter your search terms. Be sure to click the box marked Forums so that it will list responses from here. You can also mark the appropriate patches boxes as well as the tech docs and manuals.

JP

[Paula J Frazer-Campbell]

Brian

If you look at the routes if should give some indication as to where the server is finding them.
Do you have a program doing an automatic route add ?

Check your netconf file.

Paula

[BFA6]

Brian,

Have a look at the flags, if you have routes with a D flag, they are being created dynamically. It could be the router is creating these.

Regards,

Hilary

[Brian McEntire]

The flags reported by netstat -nr are: UGHD, so yes, they are being created dynamically.

The other thing, there are two routers on this LAN, the default route seems to be working fine (tested with a traceroute) BUT all of the dynamically created routes are coming from the other router.

I have other HP's on this LAN that do not have such large routing table.

I'm not running routed or any program to dynamically add routes on this system.

* Is there a way to tell this HP-UX 10.20 system to not add dynamic routes to its routing table?

[BFA6]

Hi Brian,

We have had a problem with dynamic routes before, and I think it was a routing protocol on the router itself which was causing the problem.

Regards,

Hilary

[steven Burgess_2]

Hi

Not sure how exactly they work (Where's Ron Kinnear) when you need him. ICMP redirects are probably the cause

HTH

Steve

[Ron Kinner]

I suspect since you tell us that you have two routers on your LAN and that the routes that you see are "coming from" the other router that your routes are being added because of ICMP redirects from the default router.

From man netstat:

"The routing table display indicates the available routes and their status. ...
whether the route was created dynamically (D) by a redirect or by Path MTU Discovery, ..."

The way it works is the default router gets a packet sent to it and its routing table says to send it to the other router. It forwards the packet to the other router but at the same time it send an ICMP redirect message to the originator of the packet telling them that they can save time by sending it directly to the other router. Your box gets this info and dutifully adds the route to the routing table. In 11.0 this route would be removed automatically after 5 minutes. This is controlled by ndd:

ip_ire_redirect_interval:

All routing table entries resulting from ICMP "Redirect"
messages are deleted after this much time has elapsed,
whether or not the entry has been recently used.
[60000, - ] Default: 300000 (5 minutes)

However, you have 10.20 which does not have this feature (at least, netttune -l on my old 10.0 box does not show anything useful) so apparently you are stuck with increasing routing tables.

There are a few things you could do though:

1. Have the default router stop sending ICMP redirects. On a Cisco router this is an interface command:

conf t
int eX/X
no ip redirects
end
wr me

where X/X is the ethernet interface number. The drawback here is that it will take a bit longer and it does add extra network traffic to the LAN.

2. In order for you to see thousands of routes I expect the second router has to have a connection to the internet and for some reason this is the preferred route. If the current default router does not have a path to the internet then simply change your default gateway to the second router and your problem will be solved. If it has a route to the internet (other than through the second router) then your network guy needs to find out why it doesn't think it's route is as good as the other router's.


Finally, the forum search is slow and hardly works. You get a much faster and usually more complete reply with www.google.com. Just add the words itrc forum to your search and when it comes up you click on:

repeat the search with the omitted results included

which is on the last page of the search results.

Ron