Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Client computer has only one nic configured with

dns: x.x.x.x
OS: winxp

'Gateway' computer has only one nic configured with

dns: x.x.x.x
OS: winxp

x.x.x.x is an ISP dns provider is the lan interface ip of a typical router/AP that has a public IP on the wan interface and does NAT for lan clients.

Client computer has normal internet conectivity.

route print in Client computer lists a number of entrys like this for every host Client is/has connected to:     xx     xx
hhh.hhh.hhh.hhh     xx
hhh.hhh.hhh.hhh     xx

hhh.hhh.hhh.hhh: other host that computer is/has connected xx: can't remember metric atm, nothing special I think

Looks like some routing protocol is involved but this is new to me and not precisely a standard setup.

Edit: This is my question and maybe it is not clear: The static point-to-point routes appear automatically on 'client' computer as you browse or open connections. The kind of answer i'm expecting is like this: "Gateway computer seems to be running X software/protocol/service that provides the static routes automatically to Client. Client is also probably configured with X mode/protocol/software"

share|improve this question

migrated from Jan 19 '10 at 2:03

This question came from our site for professional and enthusiast programmers.

Other than "a poor one", what sort of answer are you actually expecting here? – womble Jan 19 '10 at 2:08

It's routing with ICMP redirect.

Here's what's going on (likely, use tcpdump/wireshark to verify on either the client computer or the client's gateway):

  1. Client (.3) says "I have a packet to send to one of google's IPs."
  2. Client looks up via ARP, doesn't find the IP.
  3. Client looks up in its route table, doesn't find the IP.
  4. Client sends the packet to its configured gateway.
  5. Configured gateway (.4) looks up via ARP, doesn't find the IP.
  6. Configured gateway looks up in its route table, doesn't find the IP.
  7. Configured gateway looks at the upstream gateway (.100), notices that it's on the same Ethernet segment
  8. Configured gateway sends an ICMP redirect to the client, informing it that the gateway it really wants is the upstream gateway (.100)
  9. Client re-sends the packet to the upstream gateway
  10. Client adds the more-specific route to it's routing table
  11. Upstream gateway forwards the packet onwards.

As noted by others, the configured gateway can do interesting things rather than send the ICMP redirect, though it appears not to be configured to do so.

share|improve this answer
Interesting, this is probably it. Now how do you setup the gateway to do that? What software is the gateway running? – Vash Feb 2 '10 at 5:43
According to RFC1812, the ability to generate these is a requirement if you want to call yourself a "router"---of course, that RFC was authored by a Cisco engineer, who's devices come with ICMP redirects enabled by default (there's a global "no ip igmp-redirect" or something to disable it IIRC)... So it's going to be whatever bit of software is on the box that's making decisions about how to rewrite a packet between interfaces... – James Cape Feb 2 '10 at 11:48
If you're going to use google (or any other name) in your example, then DNS resolution has to occur between steps 1 and 2. Either from the local DNS cache or from the DNS client resolver via it's configured DNS server. – joeqwerty Feb 4 '11 at 4:08
joeqwerty: I'm using the term "google" coloquially, to refer to "a server that google owns/controls". – James Cape Feb 4 '11 at 14:09
@joeqwerty: And though it shouldn't need to be said, revenge downvoting based on an obviously pedantic misreading just makes you look like a complete tool. – James Cape Feb 4 '11 at 14:19

I'm not really sure I understand the question.

But at a guess I'd say that the machine could be running something like internet acceleration server. I've noticed that SBS etc seem to set themselves up like this. i.e. one NIC, no real firewalling as such.

Is that the kind of answer you were expecting?

share|improve this answer
Yes, this is the kind of answer I'm expecting. Learn what are the pieces involved in this setup and what is the purpose of using something like that. One question:By SBS you mean Small Business Server? Gateway comp is running windows xp, not entirely sure but isn't SBS windows server OS based? – Vash Jan 19 '10 at 3:11
Yes SBS = Windows Small Business Server – Matt Jan 19 '10 at 19:25

The two IP addresses you provided are owned by Google and Microsoft:

$ whois

OrgName:    Google Inc. 
OrgID:      GOGL

NetRange: - 
NetName:    GOOGLE


$ whois

OrgName:    Microsoft Corp 
OrgID:      MSFT

NetRange: - 

Maybe some browser plugins set these, but they look really strange to me.

Did you alread check what services are running on

share|improve this answer
The addresses where put there by me as an example. I have not the actual data but you get the idea, for every connection is made a static point to point route is spawned in routing table of client. About the services running, I found a squid server running, then I stopped it and observed no change, no conectivity lost, everything stays the same. I also verified no proxy setup in the browser I was using. – Vash Jan 19 '10 at 13:43
OK. Is it really for every connection or only for every connection made by the browser? Does e.g. Skype generate static entries too? Can you test with "netstat" what you have running on the machines? – Raffael Luthiger Jan 19 '10 at 17:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.