0

I have an Ubuntu system with an ethernet interface (eth0) connected to a router that acts as a DHCP server providing a default route. However I have set eth0 to use a static address and ignore routing since I want to run a script that will test if the router has connectivity and only add a default route via it if so. But whenever I bring the interface up, I see a default route pointing to it:

default via 192.168.100.1 dev eth0

Curiously this route has no src, metric or proto fields. And more curiously it comes and goes - repeated invocations of ip route will sometimes show it present, sometimes not.

The full output of ip route is below - currently I have a WiFi interface up and providing a default route which is what I want to use when the ethernet connected router has no connectivity. Deleting the route doesn't help - it just reappears.

Any clues on why this spurious route is appearing?

default via 192.168.100.1 dev eth0
default via 192.168.1.254 dev wlan0 proto dhcp src 192.168.1.67 metric 600
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
192.168.0.0/22 dev wlan0 proto kernel scope link src 192.168.1.67
192.168.1.254 dev wlan0 proto dhcp scope link src 192.168.1.67 metric 600
192.168.96.0/24 dev bond-lan0 proto kernel scope link src 192.168.96.254
192.168.100.0/24 dev eth0 proto kernel scope link src 192.168.100.100

The netplan config is:

network:
  version: 2
  ethernets:
    eth0:
      addresses: [192.168.100.100/24]
      dhcp4: no
      dhcp4-overrides:
        use-dns: no
        use-routes: no
    eth1:
      dhcp4: no
      addresses: []
    eth2:
      addresses: []
      dhcp4: no
  bonds:
    bond-lan0:
      interfaces: [eth1, eth2]
      addresses: [192.168.96.254/24]
      parameters:
        mode: 802.3ad
        mii-monitor-interval: 1
  wifis:
    wlan0:
      dhcp4: yes
      dhcp6: yes
      dhcp4-overrides:
        use-dns: no
      dhcp6-overrides:
        use-dns: no

Running ip mon route shows this:

Deleted 192.168.100.0/24 dev eth0 proto kernel scope link src 192.168.100.100
Deleted broadcast 192.168.100.255 dev eth0 table local proto kernel scope link src 192.168.100.100
Deleted local 192.168.100.100 dev eth0 table local proto kernel scope host src 192.168.100.100
local 192.168.100.100 dev eth0 table local proto kernel scope host src 192.168.100.100
broadcast 192.168.100.255 dev eth0 table local proto kernel scope link src 192.168.100.100
192.168.100.0/24 dev eth0 proto kernel scope link src 192.168.100.100
default via 192.168.100.1 dev eth0
Deleted 192.168.100.0/24 dev eth0 proto kernel scope link src 192.168.100.100
Deleted broadcast 192.168.100.255 dev eth0 table local proto kernel scope link src 192.168.100.100
Deleted local 192.168.100.100 dev eth0 table local proto kernel scope host src 192.168.100.100
local 192.168.100.100 dev eth0 table local proto kernel scope host src 192.168.100.100
broadcast 192.168.100.255 dev eth0 table local proto kernel scope link src 192.168.100.100
192.168.100.0/24 dev eth0 proto kernel scope link src 192.168.100.100
default via 192.168.100.1 dev eth0
Deleted 192.168.100.0/24 dev eth0 proto kernel scope link src 192.168.100.100

Repeated ad nauseum.

7
  • Does ip mon route show it being added/removed repeatedly? The lack of a 'proto' field being shown usually implies it has the default value, 'proto boot' i.e. added via manual ip route add. Are there any unusual processes in ss -f netlink 'src = rtnl' or in extrace / forkstat / execsnoop? Commented Mar 19 at 5:22
  • @u1686_grawity Yes - did not know about ip mon route, but have updated the question with the output.
    – Clyde
    Commented Mar 19 at 6:31
  • extrace seems to show the culprit is /sbin/dhclient-script: ` 39145 /bin/sh /sbin/dhclient-script 39146 run-parts --list /etc/dhcp/dhclient-enter-hooks.d 39147 systemctl is-enabled systemd-resolved 39148 ip -4 addr add 192.168.100.100/255.255.255.0 broadcast 192.168.100.255 valid_lft 5 preferred_lft 5 dev eth0 label eth0 39149 ip link set dev eth0 mtu 1500 39151 ip -4 route add default via 192.168.100.1 dev eth0 `
    – Clyde
    Commented Mar 19 at 6:41
  • That sounds like a problem – you probably don't want to have dhclient running alongside systemd-networkd... Commented Mar 19 at 6:45
  • Indeed. It seems that dhclient is being run by dhcpd which is supposed to be only acting as a server for the local LAN.
    – Clyde
    Commented Mar 19 at 6:51

2 Answers 2

1

I appear to have made the problem go away. First, the background:

I'm using netplan with systemd-networkd, so configuring by editing /etc/netplan/50-network.yaml, running netplan apply which updates files under /run/systemd/network/ which are read by systemd-network. As far as I was aware, this all supersedes the files in /etc/network/interfaces.d, which are not touched by netplan.

However, it seems that ifup still reads those files, and runs dhclient because it believes the interface is a dhcp client. There were files created in that directory during the Ubuntu install, which flagged eth0 as dhcp mode.

So I removed the files under /etc/network/interfaces.d/ and after a system reboot the spurious routes are no longer being applied.

0

Investigate using:

  • ss -f netlink "src = rtnl" to list processes that are actively connected to rtnetlink which is the primary Linux interface for adding/removing routes (as well as IP addresses and other things).

  • extrace, forkstat, execsnoop to watch for processes that correspond to brief commands like "ip route add" being repeatedly run.

  • systemctl status <pid> to determine which service a (running) process belongs to – e.g. the parent process of the "ip route add".

From your extrace/forkstat results, it seems that you have two network clients running side by side – systemd-networkd (as part of netplan) and dhclient (perhaps as part of ifupdown or NetworkManager) or something.

What likely happens:

  1. dhclient acquires a lease and adds a route;
  2. systemd-networkd (the backend used by Netplan) deletes all "foreign" routes by default;
  3. dhclient renews lease and adds the route;
  4. systemd-networkd deletes "foreign" routes;
  5. repeat

The absence of proto ... is normal – dhclient uses ip route add to add the route and does not bother specifying a custom protocol value, so it takes the default ("proto boot"), and default values are not shown in the route list (unless you use ip -d route I suppose).

1
  • Thanks for the help - your troubleshooting tips were what I needed.
    – Clyde
    Commented Mar 19 at 7:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .