Section 9: Hosts File and Routing Table

The Big Picture: Two Small Tables That Steer Everything

Two small tables decide a lot about where your traffic goes. The hosts file answers "what IP address belongs to this name?" The routing table answers "which door (adapter and gateway) should this packet leave through?"

9.1 The hosts File (Manual Name Resolution Override)

What it is: The hosts file is a plain text file in which you (or a program) can write "this name means this IP address". Windows reads it first, before the DNS cache and before any DNS server (Section 5). It is the oldest form of name lookup, from the days before DNS existed.

Where it is:

C:\Windows\System32\drivers\etc\hosts

The file has no extension (it is not hosts.txt). Open it in Notepad to read it. A default hosts file mostly contains # comment lines (lines that start with the hash sign and are ignored). A typical entry has this shape:

127.0.0.1       localhost
::1             localhost

One line has: an IP address, some spaces, then a name. That's all. Windows will return that address whenever a program asks for that name.

Key facts:

Why people use it:

• Testing: point a made-up name at a test server on your own network.
• Blocking: map an unwanted site to 0.0.0.0 so it does not load (some ad-blocking lists do this).
• Quick overrides: reach a new server by name before DNS is updated.

The security side. Because the hosts file wins over DNS, malware sometimes edits it. For example, it may map your bank's name to the attacker's server, so typing the correct name takes you to a fake site. It may also block your antivirus update sites. If a website looks "wrong" on one PC only, or antivirus updates fail, reading the hosts file is a quick check. A long list of unfamiliar entries is a warning sign. (Windows Security may also warn about or restrict changes, hedge.)

Windows tip: A name that works on your phone but not on your PC, or goes to the wrong place only on your PC, may be a hosts file entry. Also run ipconfig /flushdns after any change to the file, in case an old answer is cached.

Optional, reversible example (do this only if you want to, and only on your own PC). This shows the idea with a harmless made-up name. It needs an administrator.

1. First make a backup copy of the file (in File Explorer, copy hosts and paste it as hosts.backup in the same folder; Windows asks for admin permission).
2. Open Notepad as administrator (right-click Notepad, Run as administrator), then open the hosts file.
3. Add a line at the end: 127.0.0.1 learning.test
4. Save. Then run ping learning.test. The reply comes from 127.0.0.1, because the hosts file answered before DNS was asked.
5. Undo it: delete that line, save, and run ipconfig /flushdns. The name .test is reserved for testing and never exists on the real internet, so the example is harmless.

You can skip this example. Nothing else in the course depends on it.

9.2 route print: The Routing Table

What it is: The routing table is the list of rules the TCP/IP driver (Section 4) uses to decide where to send each packet. For every outgoing packet, Windows searches the table for the best matching row.

How to see it:

route print

or in PowerShell: Get-NetRoute. Look at the IPv4 Route Table part (IPv6 has its own).

A simplified example (your numbers will differ):

Network Destination   Netmask          Gateway        Interface        Metric
0.0.0.0               0.0.0.0          192.168.1.1    192.168.1.50     25
127.0.0.0             255.0.0.0        On-link        127.0.0.1        331
192.168.1.0           255.255.255.0    On-link        192.168.1.50     281
192.168.1.50          255.255.255.255  On-link        192.168.1.50     281
192.168.1.255         255.255.255.255  On-link        192.168.1.50     281

How to read the columns:

The special rows:

How a decision is made: The most specific match wins (the longest mask). Only if there is a tie does the metric decide.

  Destination 192.168.1.20  ──► matches 192.168.1.0/24 (on-link)  ─► send directly (ARP for its MAC)
  Destination 142.250.x.x   ──► only the default route matches ───► send to gateway 192.168.1.1
                                                                     (ARP for the GATEWAY's MAC)

Notice what happens with a faraway address: the IP packet is still addressed to the far server, but the frame is addressed (by MAC) to your gateway. This is the idea the previous chapter taught, now visible in a real table.

Why a PC can have many routes: A VPN, Hyper-V or Wi-Fi plus Ethernet at the same time adds more rows. The metric is how Windows chooses between two connections. With Automatic metric on (the default), a faster adapter gets a lower metric, so Ethernet is usually preferred over Wi-Fi.

Warning: You can add or delete routes with route add and route delete, but a wrong change can cut your PC off from the network. This course only reads the table.

Summary