Damn you, ICMP redirect!!! (or rather, how to flush a cached ICMP redirect under CentOS7/Linux)

Been a while since I added anything new here.  Been busy trying to keep my head above water I guess.  In any case, I came across a situation during $dayjob$ where I had to seperate two networks that were sharing the same VLAN to two distinct VLANS since they were actually always supposed to be seperate, and are geographically distinct as well.  The router configuration was as follows:

interface Vlan6
 ip address secondary
 ip address
 no ip redirects
 no ip proxy-arp

Networks and were essentially on a common VLAN.

Anyway, the task seemed simple, leave on VLAN6 and create VLAN5 on this router to add a routed interface between and which was being moved to another device.

 interface Vlan5
 ip address

Now, traffic from would have to transit via, being routed by two different routers.   Hosts in would have to transit via is another interface on the new router) and to get to  Simple, everyday stuff.  Right?


Well for a reason that at first escaped me, the one and only host in that had communications with could ping every other host in the network *except* the two I needed it to communicate with, and until I added the routed interfaces, was working perfectly.  I was confounded until I tried a traceroute from one of the hosts in back to

[root@host1 ~]# traceroute
traceroute to (, 30 hops max, 60 byte packets
 1  (  849.491 ms !H  849.454 ms !H  849.426 ms !H

Now why would I get a HOST_UNREACHABLE?!?!?  From MYSELF!!!!( is host1) Here is my routing table

[root@host1 ~]#  ip -4 route
default via dev eth0 dev eth0  proto kernel  scope link  src

Seems normal (?)

Other traceroutes towards hosts were working:

[root@host1 ~]# traceroute
 traceroute to (, 30 hops max, 60 byte packets
 1 (  0.225 ms  0.192 ms  0.180 ms
 2 (  5.591 ms
 3 ( 6.524 ms

My gateway for is, and the above makes sense.  It is only then I realized the host had cached an ICMP_REDIRECT for, and I checked this with the ip route command:

[root@host1 ~]# ip route get via dev eth0  src
    cache <redirected>

bingo.  Cached, ICMP_REDIRECT from, which no longer exists.  I didn’t bother to check how long the timeout is for these cached entries, however it was longer than I would have expected, especially since I troubleshot this for more than 15 minutes (*cough* *cough*).

In any case, I learned a new command to zap these, and thankfully, stuff started working again:

root@host1 ~]# ip route flush cache

And with that, my troubles were gone

[root@host1 ~]# ip route get via dev eth0  src

from my reading of various Googles, the gc_timeout is what defines the actual timeout:

[root@host1~ proc]# cat ./sys/net/ipv4/route/gc_timeout

I can safely say my troubleshooting went way past this timeout, assuming it is seconds and not minutes, and therefore there is some wonkyness beyond I need to check.  In any case, knowing how to clear the cache is evidently useful as well!

7 thoughts on “Damn you, ICMP redirect!!! (or rather, how to flush a cached ICMP redirect under CentOS7/Linux)

    • to be frank I never bothered to debug past the way to clear it. I would have to replicate/re-lab this to figure out if there is some other device sending or refreshing the false redirect

    • My understanding of the 300 second timeout is that the route would have to be *unused* for 300 second before it will drop from cache. Any time a packet gets routed with that information, the counter starts over. They will often stay around forever because of this.

  1. Thanks from me as well for the insights here.
    I found the root of the problem in RHEL7 (need the redhat account to read it):

    For those without access:
    This issue was resolved in RHSA-2016-2574 with package kernel-3.10.0-514.el7.
    Root Cause
    The sysctl net.ipv4.route.gc_timeout should control the route cache expiration time (in seconds). It defaults to 300 seconds. The route cache garbage collection routines appear to never run.

  2. Thank you, commandline.ninja. I echo earlier comments: That command
    saved me a lot of pain.

    I really, really, really did NOT want to reboot.

Leave a Reply

Your email address will not be published. Required fields are marked *

r u a bot? * Time limit is exhausted. Please reload CAPTCHA.