ip route
where a packet goes nextip route shows the table the kernel consults for every outgoing packet. Each line pairs a destination prefix with a way to reach it — directly on a link, or via a gateway. When several lines match, the longest prefix wins, and the default route is simply the shortest prefix there is.
A host does not know the path to anywhere — it knows only the next hop, and trusts that hop to know the one after.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
It is 0.0.0.0/0 written as a word: anything no other line matches is handed to 192.168.1.1. "proto dhcp" records that the DHCP client installed it.
Traffic for 10.8.0.0/24 leaves through wg0. No gateway is named because the far end is reached directly over the tunnel.
docker0 exists but has no carrier — no container is attached — so the route is present and dead.
Hosts in 192.168.1.0/24 are on the same segment. The kernel will ARP for them and send the frame straight there.
Switches
A switch changes how the command behaves. These are the ones used day to day; man ip lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-4- Show the IPv4 routing table. This is the default.
-6- Show the IPv6 routing table.
-d- Details: show the route type and other attributes usually hidden.
-c- Colour the output.
-j- Print JSON, for scripts.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
ip route get 192.0.2.10Asks the kernel which route it would actually pick for that destination — interface, gateway and source address in one line.
ip route add 10.20.0.0/16 via 192.168.1.254Adds a static route through a second gateway. Temporary until it is written into the network configuration.
ip -6 routeThe IPv6 table, which is separate and usually populated by router advertisements.
ip route show table allEvery table, including the local and policy-routing ones that the plain command hides.
In cybersecurity
Whoever controls a host's routes controls which box sees its traffic. A changed route is quieter than a changed firewall rule and does more.
Pointing the default route at an attacker-held host puts them in the path of everything. Compare it with what DHCP should have issued.
A /32 for one destination overrides the default without disturbing anything else — a targeted interception that is easy to miss.
With a VPN up, check that the sensitive prefixes really route to the tunnel. "ip route get" settles it in one line.
Rules in "ip rule" can send traffic to another table entirely. The main table can look clean while packets follow a different one.
A host with net.ipv4.ip_forward=1 and two interfaces is a router. Confirm that is intended.
A host that accepts redirects lets any neighbour install a route. Most servers should have accept_redirects disabled.