This answer is a quick summary of what the fields mean in the routing table display of
netstat. You can find all this information directly from the
netstat man page (
man netstat) or for an excellent primer, see FreeBSD's Handbook Chapter 31.2 - Gateway's and Routes. (Apple's
netstat comes from the BSD version).
The flags field shows a collection of information about the route stored as binary choices. Following is extracted directly from the man page.
1 RTF_PROTO1 Protocol specific routing flag #1
2 RTF_PROTO2 Protocol specific routing flag #2
3 RTF_PROTO3 Protocol specific routing flag #3
B RTF_BLACKHOLE Just discard packets (during updates)
b RTF_BROADCAST The route represents a broadcast address
C RTF_CLONING Generate new routes on use
c RTF_PRCLONING Protocol-specified generate new routes on use
D RTF_DYNAMIC Created dynamically (by redirect)
G RTF_GATEWAY Destination requires forwarding by intermediary
H RTF_HOST Host entry (net otherwise)
I RTF_IFSCOPE Route is associated with an interface scope
i RTF_IFREF Route is holding a reference to the interface
L RTF_LLINFO Valid protocol to link address translation
M RTF_MODIFIED Modified dynamically (by redirect)
m RTF_MULTICAST The route represents a multicast address
R RTF_REJECT Host or net unreachable
r RTF_ROUTER Host is a default router
S RTF_STATIC Manually added
U RTF_UP Route usable
W RTF_WASCLONED Route was generated as a result of cloning
X RTF_XRESOLVE External daemon translates proto to link address
Y RTF_PROXY Proxying; cloned routes will not be scoped
So, looking at the first entry, the flags are UGSc meaning
U: RTF_UP - Route usable
G: RTF_GATEWAY - Destination requires forwarding by intermediary
S: RTF_STATIC - Route added manually
c: RTF_PRCLONING - Protocol-specified generate new routes on use
Refs, Use, & Expire
refcnt field gives the current number of active uses of the route. Connection oriented protocols normally hold on to a single route for the duration of a connection while connectionless protocols obtain a route while sending to the same destination. The use field provides a count of the number of packets sent using that route.
Expire is a timeout - a period in which the host doesn't respond to that route.
MAC Address and Hardware Devices
The HEX address that you're seeing for the
10.1.0.10.1/32 network (
bc:67:1c:40:3:f6) is a MAC address, not a IPV6 address.
A MAC address is a 48-bit identifier specific to the hardware written in
MM:MM:MM:SS:SS:SS The first three bytes (
MM:MM:MM) identifies (assigned to) the hardware manufacturer and the second three bytes (
SS:SS:SS) is assigned to the device by the manufacturer.
An IPV6 address is a 106-bit hexadecimal identifier written as 8 hexidecimal numbers separated by colons: Example:
link#12 refer to the network device (i.e. Ethernet Adapter, WiFi Adapter, VPN adapter, etc.).