The Hidden Routing Shortcut
When a Linux server acts as a router (or simply sends heavy traffic across a complex network), evaluating the main routing table for every single packet is highly inefficient. To speed up network throughput, the Linux kernel utilizes a Routing Cache.
When the kernel successfully determines the optimal route to a specific destination IP address (e.g., 10.0.0.50 via the eth1 interface using gateway 192.168.1.1), it stores that exact decision in the routing cache. The next time a packet needs to go to 10.0.0.50, the kernel completely bypasses the complex routing table and instantly grabs the pre-computed path from the cache.
If a system administrator changes the primary routing table (using ip route add), but traffic is still flowing out of the wrong interface, it is usually because the kernel is stubbornly holding onto a stale entry in the routing cache. To diagnose this, you must view the cache directly.
Viewing the Routing Cache
The standard ip route command only shows the static and dynamic rules you have configured. It does not show the actual cached decisions the kernel has made in real-time.
To view the active cache, you must append the show cache flag.
ip route show cacheThe terminal will output a highly detailed list of active network flows.
10.0.0.50 via 192.168.1.1 dev eth1
cache expires 21sec mtu 1500 advmss 1460 fragtimeout 64
172.16.5.100 from 192.168.1.10 dev eth0
cache mtu 1500 localdfUnderstanding the Output
The output explicitly shows the destination IP, the gateway (via), and the physical network interface (dev) the packet is utilizing. Crucially, it also displays the expires timer. The kernel will hold onto this cached route for exactly 21 more seconds before it drops it and is forced to re-evaluate the main routing table.
Flushing the Routing Cache
If you have just updated your primary routing tables and you cannot wait for the cache timers to expire naturally (which can sometimes take up to 10 minutes depending on kernel configuration), you must forcefully flush the cache.
To delete every entry in the routing cache and force the kernel to evaluate the main routing table for all new packets, run the flush command with sudo privileges:
sudo ip route flush cacheThe command executes silently. If you immediately run ip route show cache again, the output will be entirely blank. The cache is empty.
As soon as you attempt to ping an external server or open a web page, the kernel will evaluate your new routing rules, determine the correct path, and instantly generate a fresh, accurate entry in the routing cache.
Note: In very modern Linux kernels (post 3.6), the IPv4 routing cache was fundamentally redesigned into the Forwarding Information Base (FIB) trie structure. While the true “cache” was removed to prevent DDoS vulnerabilities, the ip route show cache command is still preserved for legacy compatibility and will display active flow metrics.