CmdID

CmdID / Commands

route_ws2008

Displays and modifies the entries in the local IP routing table. Windows commands reference

On Windows

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Displays and modifies the entries in the local IP routing table. If used without parameters, route displays help at the command prompt. IMPORTANT: This command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in the properties of a network adapter in Network Connections.

route [/f] [/p] [<command> [<destination>] [mask <netmask>] [<gateway>] [metric <metric>]] [if <interface>]]

To display the entire contents of the IP routing table, type

route printIdentify

Trips 1 Sigma rule: lowSuspicious Network Command by frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'

To display the routes in the IP routing table that begin with 10, type

route print 10.*Identify

Trips 1 Sigma rule: lowSuspicious Network Command by frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'

To add a default route with the default gateway address of 192.168.12.1, type

route add 0.0.0.0 mask 0.0.0.0 192.168.12.1Identify

To add a route to the destination 10.41.0.0 with the subnet mask of 255.255.0.0 and the next hop address of 10.27.0.1, type

route add 10.41.0.0 mask 255.255.0.0 10.27.0.1Identify

To add a persistent route to the destination 10.41.0.0 with the subnet mask of 255.255.0.0 and the next hop address of 10.27.0.1, type

route /p add 10.41.0.0 mask 255.255.0.0 10.27.0.1Identify

To add a route to the destination 10.41.0.0 with the subnet mask of 255.255.0.0, the next hop address of 10.27.0.1, and the cost metric of 7, type

route add 10.41.0.0 mask 255.255.0.0 10.27.0.1 metric 7Identify

To add a route to the destination 10.41.0.0 with the subnet mask of 255.255.0.0, the next hop address of 10.27.0.1, and using the interface index 0x3, type

route add 10.41.0.0 mask 255.255.0.0 10.27.0.1 if 0x3Identify

To delete the route to the destination 10.41.0.0 with the subnet mask of 255.255.0.0, type

route delete 10.41.0.0 mask 255.255.0.0Identify

To delete all routes in the IP routing table that begin with 10, type

route delete 10.*Identify

To change the next hop address of the route with the destination of 10.41.0.0 and the subnet mask of 255.255.0.0 from 10.27.0.1 to 10.27.0.25, type

route change 10.41.0.0 mask 255.255.0.0 10.27.0.25Identify
/fClears the routing table of all entries that are not host routes (routes with a netmask of 255.255.255.255), the loopback network route (routes with a destination of 127.0.0.0 and a netmask of 255.0.0.0), or a multicast route (routes with a destination of 224.0.0.0 and a netmask of 240.0.0.0). If this is used in conjunction with one of the commands (such as add, change, or delete), the table is cleared prior to running the command.
/pWhen used with the add command, the specified route is added to the registry and is used to initialize the IP routing table whenever the TCP/IP protocol is started. By default, added routes are not preserved when the TCP/IP protocol is started. When used with the print command, the list of persistent routes is displayed. This parameter is ignored for all other commands. Persistent routes are stored in the registry location HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes.
<command>Specifies the command you want to run. The valid commands include: - add - Adds a route. - change - Modifies an existing route. - delete: - Deletes a route or routes. - print - Prints a route or routes.
<destination>Specifies the network destination of the route. The destination can be an IP network address (where the host bits of the network address are set to 0), an IP address for a host route, or 0.0.0.0 for the default route.
<mask>Specifies the next parameter for the 'netmask' value.
<netmask>Specifies the network destination subnet mask. Defaults to 255.255.255.255 if not specified.
<gateway>Specifies the forwarding or next hop IP address over which the set of addresses defined by the network destination and subnet mask are reachable. For locally attached subnet routes, the gateway address is the IP address assigned to the interface that is attached to the subnet. For remote routes, available across one or more routers, the gateway address is a directly reachable IP address that is assigned to a neighboring router.
metric <metric>Specifies an integer cost metric (ranging from 1 to 9999) for the route, which is used when choosing among multiple routes in the routing table that most closely match the destination address of a packet being forwarded. The route with the lowest metric is chosen. The metric can reflect the number of hops, the speed of the path, path reliability, path throughput, or administrative properties.
if <interface>Specifies the interface index for the interface over which the destination is reachable. For a list of interfaces and their corresponding interface indexes, use the display of the route print command. You can use either decimal or hexadecimal values for the interface index. For hexadecimal values, precede the hexadecimal number with 0x. When the if parameter is omitted, the interface is determined from the gateway address.
/?Displays help at the command prompt.