What netstat "flag" means "dynamic" for a route?

[Trever Furnish]

Can anyone point me to documentation on what the flags mean that aren't documented in the netstat manual page?

Specificly, I *think* D means the route was learned via an icmp redirect, but I've also seen mention of an "M" flag on the forums with exactly the same purpose and neither seems to be documented in the manual pages for netstat, route, or routing.

Where are the rest of the flags documented?

[Michael Steele_2]

I've seen this explicitly stated in other flavors of UNIX, like SCO:

http://uw713doc.caldera.com/en/man/html.1Mtcp/netstat.1Mtcp.html

But this doesn't seem to be a supported utility in HP-UX:

netstat -nr

Routing tables
Destination Gateway Flags Refs Use Interface
127.0.0.1 127.0.0.1 UH 0 136 lo0
default 10.0.0.2 U 0 3846 lan0

"...The Flags field shows whether the route is up (U), whether the route is to a gateway (G), or whether the route is a host or network route (with or without H)..."

[Caesar_3]

Hello!

Check this:
http://www.doc.ic.ac.uk/~mac/manuals/hpux-manual-pages/hpux/usr/man/man1/netstat.1.html

http://snowhite.cis.uoguelph.ca/course_info/27420/netstat.html

http://www.scit.wlv.ac.uk/cgi-bin/mansec?1M+netstat

Caesar

[Michael Steele_2]

Pssst, its 2003.

Gee, only problem with the above is the following:

Hewlett-Packard Company HP-UX Release 9.0: August 1992

[Trever Furnish]

Thanks. Still wondering though, since I haven't found any doc that seems authoritative.

It's pretty depressing that such a core utility is so poorly supported by HP - surprising, actually.

The devil's in the details - I need to know all the possible flags and what circumstances cause them, and I need that information to be exact and accurate on hpux 10.20, 11.00, and 11.11.

Frustratingly, there seems to be a D flag on 10.20 and 11.00, but no flag whatsoever on 11.11. :-(

I suppose I'll open a software call - at least maybe get an answer for 11.11.

[Pete Randall]

Trever,

I was going to say the "d" flag, but as I got ready to hit the reply button I noticed your last post. There's no "d" in 11.11????? Really??? I'd be very interested to find out what you learn from your software call. Could you please post the results?

Thanks,


Pete

[Trever Furnish]

Ok, for future reference and for anyone still listening...

The D flag in the output of netstat under hpux 11.xx was removed. If you look closely, you'll see that the mention of the D flag was also removed from the netstat manual page on 11.xx. So D is there on 10.20, but not on 11.xx.

I have an open ticket requesting information on how to identify dynamic routes as a result. A very helpful engineer, Pete M., has reported that he's not yet found a reason that it was removed, and that there's an open change request to have it put back (which has not yet been acted on).

Pete also made me aware that the behavior of hpux with respect to icmp_redirect routes has changed as of hpux11.00 and at least one more since then (depending on patch level). Now there's an ndd-tunable parameter that controls how long an icmp_redirect route lives in the table, and by default it is either five minutes or five seconds or zero seconds (again, depending on patch level). This behavior would seem to negate the need for the script most of us are probably running that periodically removed routes that used to be marked with the D flag.

On my systems, the default always seems to be five minutes, although I've got it set to ten.

The parameter is named ip_ire_redirect_interval.

More info:
/usr/bin/ndd -h ip_ire_redirect_interval

ip_ire_redirect_interval:

All routing table entries resulting from ICMP "Redirect"
messages are deleted after this much time has elapsed,
whether or not the entry has been recently used.
[60000, - ] Default: 300000 (5 minutes)

And to read the value, of course:
/usr/bin/ndd -get /dev/ip ip_ire_redirect_interval

And one last tidbit, Pete also provided the following ndd command for dumping the routing table, which includes IRE_ROUTE_REDIRECT for routes that result from icmp redirects:

ndd -get /dev/ip ip_ire_hash

...
ire: 0x4b5ed4d8, addr 018.181.000.031, mask 255.255.255.255, src 192.168.010.114, type IRE_ROUTE_REDIRECT, next 0x0, hash 0xaa
...

The route listed there is a dynamic one. The command actually dumps the full table, this is just the dynamic one for illustration.

Pete also said he'd check to see if he can find an rfc that says the D flag in the output of netstat is mandatory, which I imagine would make it more likely to re-appear in a future patch. All in all, that's a lot of support considering that identifying ip_ire_redirect_interval actually solved my problem. Pete rocks! :-)