Show kernel routing exception entries (FIB)

Question

Linux 3.6 removed the ipv4 routing cache (commit).
Changelog says:

Remove the ipv4 routing cache. Now lookups go directly into the FIB trie and use prebuilt routes cached there.

According to this question, the routing cache entries are now stored in a "routing exception" structure which is a part of the routing entry.

On my 3.16 (Debian Jessie) standard distribution kernel, I can't see any exceptions and ip route show cache doesn't return anything. The routing table only has a default route:

~#ip route show
default via 10.11.2.30 dev eth0
10.11.0.0/16 dev eth0 proto kernel scope link src 10.11.1.76

Q1: How can I list all of these routing exceptions that are known to the kernel?
Q2: How can I selectively remove such an exception?
Q3: Why does the kernel not select the correct default gateway when trying to ping a certain host:

ping 10.30.104.23
PING 10.30.104.23 (10.30.104.23) 56(84) bytes of data.
From 10.11.1.11 icmp_seq=1 Destination Protocol Unreachable

Addition for Q3: I suspect that this (now obsolete) route was probably stored (somewhere) because of a ICMP redirect. But if ip route show cache does not list routing exceptions and the default route says otherwise - where is this bit of information stored?

Answer 1

OK, after much digging I think I have the answers:

A1: Since 3.6 it's no longer possible to list the entire routing cache. You can see the routing cache for specific IPs using ip route get to A.B.C.D but can't list all of them.

A2: ip route flush cache to A.B.C.D removes a single entry from the route cache.

A3: Argh, could have known that: Because it first consults the routing cache a.k.a. FIB (forwarding information base) and after that it looks at the routing table.
See this PDF for a detailed diagram.