I am trying to understand the packet traversal in Linux. I found a diagram from link.
My linux box has the following routing table:
default via 192.168.2.1 dev wlan0 proto static metric 1024 169.254.0.0/16 dev wlan0 scope link metric 1000 192.168.2.0/24 dev wlan0 proto kernel scope link src 192.168.2.73
If I send a ping to 22.214.171.124:
- It would first pass OUTPUT table rules
- The routing decision will check routing table and use the default route which states using the device wlan0
- It will pass POSTROUTING rules and will be send out on wlan0
For the ping response, assuming it arrives on wlan0, it would first pass the PREROUTING rules. My question is that at this point, what will it gain by checking the routing table because the diagram suggest a routing decision is made; or is it just to check if a packet does not have IP associated with any of the interfaces on the machine ?