For a outgoing packet, by route I can know which interface is using, but for a incoming packet, how to find out which interface is using?

  • Well, you know which IPs are bound to each interface, right? – EEAA Mar 16 '17 at 1:17

You're looking for the ip route get command. This is the equivalent of the BSD route get.

ip route get for example will display what route will be used to get to that IP. This command does not resolve host names on its own.

  • via dev eth0 src, what does this mean? – Sato Mar 16 '17 at 1:28
  • Well, that's the route it took. It got to (destination address) via (the gateway) on device eth0 (answering your question) from the source (which is of course on eth0). – Spooler Mar 16 '17 at 1:30
  • But how to know which interface will be used when a packet comes in? For example for a packet from to, which will be used? and for a packet from to, which will be used? Its same with the outgoing packet? – Sato Mar 16 '17 at 1:37
  • In that case, you're communicating with <something> to, which is bound to eth0. – Spooler Mar 16 '17 at 1:40

In general, Linux expects a packet to enter through the same interface as it would exit.

When that is not the case, the kernel reports a packet as a martian, and if you have the following sysctl value set, packets will be dropped if they are seen from an interface which cannot route back to the (the rp in rp_filter standard for Reverse Path).

net.ipv4.conf.all.rp_filter = 1

So normally, unless you have a particularly complicated routing table or setup, you can check the output of ip r and make an educated guess. Most likely, you will want to check what your default route is, and there will be a strong chance that the answer to your question will be "whatever interface your default route is pointing to".

All of the above can be changed by the admins if necessary, but in general, AFAIK this is how most systems work.


the packet will come from its ip address interface ( destination address) otherwise it will not reach the interface and the packet is ignored ( like in a hub) if the packet is a broadcast then it will come from all the interfaces connected to that broadcast domain ( one of the reason why only one ip should be in the same ip subnet)

same goes at MAC level

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.