{
	"id": "8edacbed-26ba-4a6b-b30a-35572105058c",
	"created_at": "2026-04-06T00:15:52.635728Z",
	"updated_at": "2026-04-10T03:35:21.462552Z",
	"deleted_at": null,
	"sha1_hash": "be4b06be04e0133b59fd7edd3471cecd5aee3306",
	"title": "Route",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 64781,
	"plain_text": "Route\r\nArchived: 2026-04-05 19:13:22 UTC\r\nDisplays and modifies the entries in the local IP routing table. Used without parameters, route displays help.\r\nSyntax\r\nroute [-f] [-p] [Command [Destination] [mask Netmask] [Gateway] [metric Metric]] [if Interface]]\r\nParameters\r\n-f   : Clears the routing table of all entries that are not host routes (routes with a netmask of 255.255.255.255), the\r\nloopback network route (routes with a destination of 127.0.0.0 and a netmask of 255.0.0.0), or a multicast route\r\n(routes with a destination of 224.0.0.0 and a netmask of 240.0.0.0). If this is used in conjunction with one of the\r\ncommands (such as add, change, or delete), the table is cleared prior to running the command.\r\n-p   : When used with the add command, the specified route is added to the registry and is used to initialize the IP\r\nrouting table whenever the TCP/IP protocol is started. By default, added routes are not preserved when the TCP/IP\r\nprotocol is started. When used with the print command, the list of persistent routes is displayed. This parameter is\r\nignored for all other commands. Persistent routes are stored in the registry location\r\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\PersistentRoutes.\r\nCommand   : Specifies the command you want to run. The following table lists valid commands.\r\nCommand Purpose\r\nadd Adds a route.\r\nchange Modifies an existing route.\r\ndelete Deletes a route or routes.\r\nprint Prints a route or routes.\r\nDestination   : Specifies the network destination of the route. The destination can be an IP network address (where\r\nthe host bits of the network address are set to 0), an IP address for a host route, or 0.0.0.0 for the default route.\r\nhttps://technet.microsoft.com/en-us/library/bb490991.aspx\r\nPage 1 of 5\n\nmask   Netmask   : Specifies the netmask (also known as a subnet mask) associated with the network destination.\r\nThe subnet mask can be the appropriate subnet mask for an IP network address, 255.255.255.255 for a host route,\r\nor 0.0.0.0 for the default route. If omitted, the subnet mask 255.255.255.255 is used. Because of the relationship\r\nbetween the destination and the subnet mask in defining routes, the destination cannot be more specific than its\r\ncorresponding subnet mask. In other words, there cannot be a bit set to 1 in the destination if the corresponding bit\r\nin the subnet mask is a 0.\r\nGateway   : Specifies the forwarding or next hop IP address over which the set of addresses defined by the\r\nnetwork destination and subnet mask are reachable. For locally attached subnet routes, the gateway address is the\r\nIP address assigned to the interface that is attached to the subnet. For remote routes, available across one or more\r\nrouters, the gateway address is a directly reachable IP address that is assigned to a neighboring router.\r\nmetric   Metric   : Specifies an integer cost metric (ranging from 1 to 9999) for the route, which is used when\r\nchoosing among multiple routes in the routing table that most closely match the destination address of a packet\r\nbeing forwarded. The route with the lowest metric is chosen. The metric can reflect the number of hops, the speed\r\nof the path, path reliability, path throughput, or administrative properties.\r\nif   Interface   : Specifies the interface index for the interface over which the destination is reachable. For a list of\r\ninterfaces and their corresponding interface indexes, use the display of the route print command. You can use\r\neither decimal or hexadecimal values for the interface index. For hexadecimal values, precede the hexadecimal\r\nnumber with 0x. When the if parameter is omitted, the interface is determined from the gateway address.\r\n/?   : Displays help at the command prompt.\r\nLarge values in the metric column of the routing table are the result of allowing TCP/IP to automatically\r\ndetermine the metric for routes in the routing table based on the configuration of IP address, subnet mask,\r\nand default gateway for each LAN interface. Automatic determination of the interface metric, enabled by\r\ndefault, determines the speed of each interface and adjusts the metrics of routes for each interface so that\r\nthe fastest interface creates the routes with the lowest metric. To remove the large metrics, disable the\r\nautomatic determination of the interface metric from the advanced properties of the TCP/IP protocol for\r\neach LAN connection.\r\nNames can be used for Destination if an appropriate entry exists in the local Networks file stored in the\r\nsystemroot\\System32\\Drivers\\Etc folder. Names can be used for the gateway as long as they can be\r\nresolved to an IP address through standard host name resolution techniques such as Domain Name System\r\n(DNS) queries, use of the local Hosts file stored in the systemroot\\system32\\drivers\\etc folder, and\r\nNetBIOS name resolution.\r\nIf the command is print or delete, the Gateway parameter can be omitted and wildcards can be used for the\r\ndestination and gateway. The Destination value can be a wildcard value specified by an asterisk (*). If the\r\ndestination specified contains an asterisk (*) or a question mark (?), it is treated as a wildcard and only\r\nmatching destination routes are printed or deleted. The asterisk matches any string, and the question mark\r\nmatches any single character. For example, 10.*.1, 192.168.*, 127.*, and *224* are all valid uses of the\r\nasterisk wildcard.\r\nhttps://technet.microsoft.com/en-us/library/bb490991.aspx\r\nPage 2 of 5\n\nUsing an invalid combination of a destination and subnet mask (netmask) value displays a \"Route: bad\r\ngateway address netmask\" error message. This error message appears when the destination contains one or\r\nmore bits set to 1 in bit locations where the corresponding subnet mask bit is set to 0. To test this condition,\r\nexpress the destination and subnet mask using binary notation. The subnet mask in binary notation consists\r\nof a series of 1 bits, representing the network address portion of the destination, and a series of 0 bits,\r\nrepresenting the host address portion of the destination. Check to determine whether there are bits in the\r\ndestination that are set to 1 for the portion of the destination that is the host address (as defined by the\r\nsubnet mask).\r\nThe -p parameter is only supported on the route command for Windows NT 4.0, Windows 2000,\r\nWindows Millennium Edition, and Windows XP. This parameter is not supported by the route command\r\nfor Windows 95 or Windows 98.\r\nThis command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in\r\nthe properties of a network adapter in Network Connections\r\nExamples\r\nTo display the entire contents of the IP routing table, type:\r\nroute print\r\nTo display the routes in the IP routing table that begin with 10., type:\r\nroute print 10.*\r\nTo add a default route with the default gateway address of 192.168.12.1, type:\r\nroute add 0.0.0.0 mask 0.0.0.0 192.168.12.1\r\nTo add a route to the destination 10.41.0.0 with the subnet mask of 255.255.0.0 and the next hop address of\r\n10.27.0.1, type:\r\nroute add 10.41.0.0 mask 255.255.0.0 10.27.0.1\r\nTo add a persistent route to the destination 10.41.0.0 with the subnet mask of 255.255.0.0 and the next hop address\r\nof 10.27.0.1, type:\r\nroute -p add 10.41.0.0 mask 255.255.0.0 10.27.0.1\r\nTo add a route to the destination 10.41.0.0 with the subnet mask of 255.255.0.0, the next hop address of 10.27.0.1,\r\nand the cost metric of 7, type:\r\nroute add 10.41.0.0 mask 255.255.0.0 10.27.0.1 metric 7\r\nTo add a route to the destination 10.41.0.0 with the subnet mask of 255.255.0.0, the next hop address of 10.27.0.1,\r\nand using the interface index 0x3, type:\r\nhttps://technet.microsoft.com/en-us/library/bb490991.aspx\r\nPage 3 of 5\n\nroute add 10.41.0.0 mask 255.255.0.0 10.27.0.1 if 0x3\r\nTo delete the route to the destination 10.41.0.0 with the subnet mask of 255.255.0.0, type:\r\nroute delete 10.41.0.0 mask 255.255.0.0\r\nTo delete all routes in the IP routing table that begin with 10., type:\r\nroute delete 10.*\r\nTo change the next hop address of the route with the destination of 10.41.0.0 and the subnet mask of 255.255.0.0\r\nfrom 10.27.0.1 to 10.27.0.25, type:\r\nroute change 10.41.0.0 mask 255.255.0.0 10.27.0.25\r\nFormatting legend\r\nFormat Meaning\r\nItalic Information that the user must supply\r\nBold\r\nElements that the user must type exactly as\r\nshown\r\nEllipsis (...)\r\nParameter that can be repeated several times in a\r\ncommand line\r\nBetween brackets ([]) Optional items\r\nBetween braces ({}); choices separated by pipe (|).\r\nExample: {even|odd}\r\nSet of choices from which the user must choose\r\nonly one\r\nCourier font Code or program output\r\nCommand-line reference A-Z\r\nTCP/IP utilities and services\r\nhttps://technet.microsoft.com/en-us/library/bb490991.aspx\r\nPage 4 of 5\n\nSource: https://technet.microsoft.com/en-us/library/bb490991.aspx\r\nhttps://technet.microsoft.com/en-us/library/bb490991.aspx\r\nPage 5 of 5",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://technet.microsoft.com/en-us/library/bb490991.aspx"
	],
	"report_names": [
		"bb490991.aspx"
	],
	"threat_actors": [
		{
			"id": "2864e40a-f233-4618-ac61-b03760a41cbb",
			"created_at": "2023-12-01T02:02:34.272108Z",
			"updated_at": "2026-04-10T02:00:04.97558Z",
			"deleted_at": null,
			"main_name": "WildCard",
			"aliases": [],
			"source_name": "ETDA:WildCard",
			"tools": [
				"RustDown",
				"SysJoker"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "256a6a2d-e8a2-4497-b399-628a7fad4b3e",
			"created_at": "2023-11-30T02:00:07.299845Z",
			"updated_at": "2026-04-10T02:00:03.484788Z",
			"deleted_at": null,
			"main_name": "WildCard",
			"aliases": [],
			"source_name": "MISPGALAXY:WildCard",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434552,
	"ts_updated_at": 1775792121,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/be4b06be04e0133b59fd7edd3471cecd5aee3306.pdf",
		"text": "https://archive.orkl.eu/be4b06be04e0133b59fd7edd3471cecd5aee3306.txt",
		"img": "https://archive.orkl.eu/be4b06be04e0133b59fd7edd3471cecd5aee3306.jpg"
	}
}