I'm practicing penetration testing and I'm in front of a basic routing exercise. The context is the following: I'm using a virtual machine with Kali Linux from which I connect in VPN to the network that provides hosts for the exercises. Before connecting, typing the route command I get the following output:

root@kali:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         _gateway         UG    100    0        0 eth0   U     100    0        0 eth0

after the connection instead, this one:

root@kali:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         _gateway         UG    100    0        0 eth0   U     100    0        0 eth0   U     0      0        0 tap0

and this is the output of the ip route command:

root@kali:~# ip route show table main
default via dev eth0 proto dhcp metric 100 dev eth0 proto kernel scope link src metric 100 dev tap0 proto kernel scope link src

So, the is the internal network; from this one, it is possible to reach other networks. One of the task is to find wich ones and add a route to reach them.

To find the network, I have a wireshark file that show as from the network's hosts, we can reach 2 web server, with these ip address:

So, what I have to do is to add a route from my internal network to this 2 others. The problem is that I have NOT the gateway of this network, cause "How many routers there are in the network" is one of the proposed question. So, If i want execute these command:

ip route add -net gateway_address dev tap0
ip route add -net gateway_address dev tap0

what I miss is the gateway_address parameter. I tried to execute the command without this parameter, or:

ip route add -net dev tap0

but, of course, I got the Destination Host Unreachable error when I try to ping one of the host.

So, my question is: how can I find the gateway address? May be the use of the wireshark file? And if yes, what I must search inside it?

  • Have you tried a simple traceroute to see if it shows the path?
    – Jesse P.
    Aug 25 '18 at 13:51
  • Did you try for the gateway address to the network? Or maybe there is something else that looks like a gateway that show up in wireshark or maybe in arp -a?
    – hft
    Sep 25 '18 at 22:48
  • Look for IP packets with a source / destination address not in the subnet (ignoring things like dhcp where you may find The corresponding link layer addresses will be that of a router
    – Torin
    Dec 24 '18 at 23:08

My suggestion is to ping that address and check the TTL value and with tcpdump verify the path that the ICMP packets takes, over tap0 or eth0 according your configuration, if you get the ICMP destination unreachable is because your router can not find the address. As other users suggest you can use traceroute and verify the path, but with your setup probably with pings you will make it work.


If this is a common ethernet network, the first step is to get the MAC-address of the packets to/from the ip-addresses to the other network (for example (the gateway substituted the real MAC-address with its own) and then scan the network for the IP-address with the same MAC-address in the network (using nmap or something similar).

Not the answer you're looking for? Browse other questions tagged or ask your own question.