CCNA online course

Route Poisoning in Distance-Vector Routing

Learn how route poisoning prevents distance-vector routing loops, how RIP uses metric 16, and how poisoning relates to poison reverse, split horizon, timers, and triggered updates.

Route poisoning is a loop-prevention technique used by distance-vector routing protocols. When a router detects that a previously reachable network has failed, it advertises that network with the protocol's infinity metric. This tells neighboring routers that the destination must no longer be used through that router.

RIP provides the clearest example. RIP measures distance in hops, and a metric of 16 means unreachable. Therefore, a RIP router can withdraw a failed route by advertising it with metric 16 instead of waiting for neighbors to discover the failure through normal periodic updates.

Prerequisites

You should understand basic routing-table fields such as a destination prefix, next hop, outgoing interface, administrative distance, and metric. Familiarity with computer networking fundamentals, dynamic routing, and RIP updates is also useful.

What Route Poisoning Means

A distance-vector router shares reachability information with neighboring routers. The information normally includes a destination network and a metric that represents the distance to that network. A router does not maintain the complete topology map that a link-state router maintains; it learns routes from its neighbors.

Route poisoning changes the metric for a failed destination to the protocol-specific infinity value and advertises the result to neighbors. The advertisement is not saying that the destination is merely expensive to reach. It is a withdrawal signal:

• The destination was previously reachable.
• The router can no longer use its local path to reach it.
• Neighbors must invalidate the route learned through that router.
• Packets should not be forwarded using the poisoned path.

The infinity value depends on the protocol. RIP uses a hop-count value of 16. Another distance-vector protocol may use a different metric type and a different maximum value.

Why Distance-Vector Routing Can Form Loops

A routing loop occurs when packets are forwarded repeatedly among routers because their routing information is incorrect or inconsistent. Distance-vector protocols are particularly exposed to this problem because routers learn about destinations from neighbors and may not know the complete path behind an advertisement.

Stale information after a failure

Imagine that R1 reaches a destination through R2, and R2 reaches it through R3. If the destination or the link to it fails, R3 may detect the failure immediately. However, R1 and R2 may still contain older information. During that period, one router might incorrectly believe that another neighbor still has a usable path.

For example, R2 could advertise a destination to R1 because R2 has not yet learned that the destination failed. R1 might then advertise its old route back to R2. Each router can interpret the other's information as an alternate path, even though neither has a working path.

The count-to-infinity problem

Count to infinity is a distance-vector failure condition in which routers repeatedly increase a route metric while continuing to believe that the destination is reachable. A simplified exchange might look like this:

1. The destination fails, but stale route information remains.
2. R1 believes R2 can reach the destination at metric 2.
3. R1 advertises the destination to R2 at metric 3.
4. R2 treats that advertisement as a possible path and advertises metric 4.
5. The metric continues increasing with later updates until the protocol's infinity value is reached or another safeguard stops the process.

While this occurs, traffic can loop between routers. Waiting for ordinary periodic updates is not ideal because stale information may remain in the network for several update cycles. Route poisoning and other loop-prevention mechanisms communicate the withdrawal more directly.

Infinity Metrics in Different Protocols

An infinity metric is not a universal number. It is defined by the routing protocol. Always interpret the metric according to that protocol's rules.

RIP's hop-count infinity

RIP uses hop count as its metric. Each router crossed adds one hop. RIP treats a destination at 16 hops as unreachable, so the largest usable hop count is 15.

A RIP metric of 16 is therefore not a high-cost forwarding route. It represents route withdrawal. Other distance-vector protocols use their own definitions of distance, maximum metric, and unreachable state.

How Route Poisoning Works After a Failure

The process begins when a router detects a topology change. Possible causes include a failed interface, a lost next hop, or withdrawal of a connected network.

1. Failure detection: The router determines that the destination is no longer reachable through the previously valid path.
2. Metric replacement: The router changes the destination's metric to the protocol's infinity value. For RIP, this is metric 16.
3. Poisoned advertisement: The router sends the unreachable route to its neighbors. This is commonly sent as a triggered update, immediately after the change, rather than waiting for the next periodic update.
4. Neighbor processing: A neighbor receiving the infinity metric removes the usable route or marks it invalid, depending on the protocol's implementation and timer state.
5. Propagation: The neighbor can advertise the unreachable state to other neighbors, allowing the withdrawal to spread through the distance-vector domain.

Poisoning helps accelerate convergence, which is the process by which routers reach a consistent view of reachability after a change. It does not guarantee that every router learns the change simultaneously.

Three-Router RIP Example

Consider this topology:

• R1 connects to R2.
• R2 connects to R3.
• R3 connects to a LAN named 192.0.2.0/24.

Before a failure, R1 reaches the LAN through R2 and R3. A simplified view might show the following route information:

In this example, the LAN-facing connection on R3 fails. R3 replaces the previously valid metric with 16 and sends the poisoned route. R2 processes the update and no longer treats R3 as a valid path. R2 then communicates the withdrawal toward R1. R1 avoids forwarding traffic toward a destination that no longer has a valid route.

Route Poisoning Versus Poison Reverse

Route poisoning and poison reverse are related, but they are not interchangeable terms.

Route poisoning means advertising a failed or unreachable route to neighbors using the infinity metric. It communicates that a destination previously reachable through the advertising router must no longer be used.

Poison reverse means advertising a learned route back toward the neighbor from which it was learned, but advertising it with the infinity metric. Its purpose is especially to prevent a two-router loop.

Suppose R1 learned a destination from R2. With poison reverse, R1 tells R2 that the destination is unreachable when advertising the route back toward R2. This prevents R2 from believing that R1 can provide a valid alternate path to the same destination.

Related Distance-Vector Safeguards

Route poisoning is one part of a broader set of mechanisms. No single mechanism should be treated as a complete solution for every distance-vector failure scenario.

Split horizon

Split horizon follows this rule: do not advertise a route out of the interface on which that route was learned. It prevents a router from immediately sending a learned path back to the router that supplied it.

Split horizon with poison reverse

Split horizon with poison reverse does not simply suppress the advertisement. Instead, it sends an explicit advertisement for the route with the infinity metric. This makes the route's invalid state clear to the neighbor and is particularly useful for preventing two-router loops.

Route timers

Distance-vector protocols use timers to control route aging. Exact names and values vary, but the concepts commonly discussed with RIP include:

• Invalid timer: The period after which a route is considered invalid because valid updates have not been received.
• Hold-down timer: A period during which the router limits acceptance of updates that could reintroduce incorrect information after a failure.
• Flush timer: The period after which an invalid route is removed from the routing table or routing database.

Timers help clean up stale routes, but waiting for timers can be slower than sending a triggered poisoned update. During convergence, routers may still have temporarily inconsistent information.

RIP Route Entries and Expected Observations

A RIP route in a Cisco IOS routing table normally identifies the destination prefix, the administrative distance and metric, the next-hop address, the time since the route was learned or updated, and the outgoing interface. When a valid path fails, the route may disappear from the active routing table while related protocol state remains visible temporarily during invalid, hold-down, or flush processing.

Useful observations include:

• show ip route displays the active routing table and whether the destination is currently installed.
• show ip route rip filters the display to routes learned through RIP.
• show ip protocols displays RIP configuration, participating networks, timers, and update behavior.
• show ip rip database displays RIP route information held by the RIP process.
• debug ip rip can display RIP updates, including route metrics, while the event occurs.

After shutting down the interface that provides the destination, you should expect the detecting router to mark the route unreachable and send a triggered update. Neighboring routers should receive the metric-16 information and stop using the failed path. Debug output and the RIP database can show the poisoned metric even when the unusable route is no longer installed for forwarding.

Building a Small Cisco IOS RIP Lab

A three-router lab can demonstrate the concept. Configure RIP version 2 on each router and advertise the connected networks used by the test topology. A simplified configuration pattern is:

router rip
 version 2
 no auto-summary
 network <connected-network-1>
 network <connected-network-2>

Replace the placeholders with the actual networks in your lab. Use no auto-summary when discontiguous addressing or clearly classless behavior is required. Automatic summarization and RIP version selection can affect lab results, but they are separate from the route-poisoning concept.

If a LAN should be advertised but should not receive RIP updates, configure a passive interface selectively:

router rip
 passive-interface <lan-interface>

After the routers have learned the destination, shut down the interface or remove the connected network that provides it. Then compare show ip route, show ip rip database, and debug ip rip before and after the failure. Stop debugging when finished with undebug all.

Convergence and Limitations

Poisoned routes help speed the withdrawal of unreachable destinations because the detecting router does not wait for the next ordinary periodic update. Neighbors can invalidate the route and propagate the information sooner.

However, poisoning does not make convergence instantaneous. Updates travel between neighbors, routers may process them at different times, and timer states can temporarily preserve information. During this interval, a short-lived inconsistency or loop may still occur. Split horizon, poison reverse, triggered updates, and timers work together to reduce these risks.

RIP's finite infinity value limits how far count-to-infinity can progress. That bound is useful for controlling the duration of the problem, but it also limits RIP to relatively small hop-count topologies. A path that requires more than 15 hops cannot be represented as reachable in RIP, even if the physical network could forward the traffic.

For comparison, link-state protocols build a topology database and calculate paths from that shared information. See the OSI reference model for foundational networking terminology and OSPF configuration for a contrasting link-state routing example.

Troubleshooting Route-Poisoning Symptoms

A route remains after the remote network fails

• Verify that the failure is visible to the router that originally advertised the network.
• Confirm that the relevant interfaces participate in RIP and that neighbor communication is working.
• Inspect RIP updates to determine whether metric 16 is being sent and received.
• Check whether the route is temporarily present because invalid, hold-down, or flush timers have not completed.

The conceptual resolution is to ensure that the failed route is advertised as unreachable and allow triggered updates and timers to complete.

Traffic loops between two routers

• Inspect the next hop and changing RIP metrics on both routers.
• Check split horizon or split horizon with poison reverse on the relevant interfaces.
• Look for a topology that permits stale advertisements to be interpreted as alternate paths.

Validate that the poisoned update propagates and that the applicable loop-prevention mechanisms are operating as expected.

A RIP route with metric 16 is visible

Metric 16 means unreachable. It is not a usable high-cost route. Identify the upstream interface, neighbor, or connected network failure that caused the poisoning, and check whether another valid route exists.

Key Takeaways

• Route poisoning advertises a failed destination with the protocol's infinity metric.
• Its purpose is to withdraw stale reachability information and reduce routing loops.
• RIP uses hop count, and metric 16 means unreachable; metric 15 is still reachable.
• A triggered update commonly carries the poisoned route before the next periodic update.
• Poison reverse sends a learned route back toward its source with an infinite metric and is especially useful against two-router loops.
• Split horizon, timers, triggered updates, and route poisoning are complementary safeguards.
• Temporary inconsistencies can still occur during convergence, and RIP's limited hop-count range restricts its use in larger topologies.