~/tutorials/019-where-your-packets-leave.md

019: Where your packets actually leave

ip route printed a table in lesson four, and you read the first line. This lesson reads the whole thing, because "where does my traffic actually go" is the question behind half of security: the answer names your gateway, your link, and every box that gets to see your packets first.

The table

ip route

Two lines on this host, and neither is filler. Read them as sentences. In prose, so you can compare against what the shell prints: default via 172.104.5.1 dev eth0 proto static and 172.104.5.0/24 dev eth0 proto kernel scope link src 172.104.5.114.

The first line, word by word

default is the route of last resort: any destination the second line cannot answer. via 172.104.5.1 names the gateway, which is the box that accepted responsibility for forwarding everything else. dev eth0 says which wire. proto static means a person typed this, which is worth knowing: somebody configured this host on purpose, and misconfigurations start in lines people typed.

The gateway is the first machine to see every outbound packet you send. On your home network it is your router. On this host it is the cloud provider's edge. Same role: a stranger you trust by necessity, running software you did not choose, seeing traffic you did not consent to show it specifically.

The second line, word by word

172.104.5.0/24 is the local subnet: 254 addresses on this segment. proto kernel means the kernel derived it from the interface configuration rather than a person typing it. scope link means these addresses are reachable without a router, one hop, same wire. src 172.104.5.114 is the source address this host will stamp on packets for that segment, which is your own address on this network.

The two together

ip -br addr | grep eth0

The grep keeps the one line that matters, and it reads eth0 UP 172.104.5.114/24: interface, state, address. The full command prints the loopback line too.

On your own machine: the default gateway should be inside your interface's subnet, and it should be the router you can point at physically. When something breaks at home, this pair of commands is the first five seconds of every diagnosis.

Try it

Each of these has one answer, and the shell gives it to you. Check yourself.

1. Read the default route aloud as a sentence: who forwards, on which wire, configured by whom?
2. What subnet is local, and which address does this host use inside it?
3. On your own machine, run ip route and ip -br addr. Is the gateway inside your subnet? Name the physical box it belongs to. If you cannot, you have found the exercise.
4. ip with no subcommand prints a usage line. Read it, then say which form answers "what is my address" and which answers "who forwards my packets".

The snapshot is a host that changes rarely. The command is the current truth.