VMware ESXi and vSphere Cluster Management

Route Poisoning Explained

Learn how route poisoning prevents routing loops in distance-vector protocols, including RIP metric 16, triggered updates, and related mechanisms.

Route poisoning is a loop-prevention technique used by distance-vector routing protocols. When a router determines that a destination is no longer reachable, it advertises that destination with the protocol's infinite metric, meaning unreachable.

The purpose is to quickly tell neighboring routers that a formerly valid route has failed. Instead of allowing neighbors to continue using stale information, the failed destination is explicitly withdrawn from the routing domain.

Prerequisites

Basic IPv4 addressing and prefix notation
Connected, static, and dynamically learned routes
Routing table fields such as destination, next hop, interface, and metric
Fundamentals of distance-vector routing
RIP operation and hop-count metrics

What Is Route Poisoning?

A distance-vector routing protocol is a protocol family in which routers exchange destination reachability and metric information with neighboring routers. Each router uses the information received from neighbors to select paths.

Route poisoning occurs when a router advertises a failed destination using the protocol-defined value for infinity. This value represents an unreachable destination. The router is not claiming that the destination has a very expensive path; it is stating that the destination must not be used through that advertisement.

The process normally has three important goals:

Detect that a directly connected network or an installed route is no longer reachable.
Make the route unusable in the detecting router's local routing information.
Notify neighboring routers promptly so they can withdraw their copies of the route.

Why Route Poisoning Helps Prevent Loops

A routing loop occurs when packets circulate among routers because the routers have inconsistent or stale routing information. For example, one router might believe that a failed network is reachable through a neighbor, while that neighbor believes the network is reachable through the first router.

Without an explicit unreachable advertisement, stale routes may continue to be exchanged. Each router can incorrectly increase the metric and send traffic toward another router. This behavior is associated with the distance-vector count-to-infinity problem.

Route poisoning reduces this risk by advertising an explicit infinite metric. Neighboring routers learn that the destination is no longer valid through that path and stop forwarding traffic toward the router that reported the failure. The withdrawal can then be propagated through the rest of the distance-vector domain.

Failure Detection and Advertisement Behavior

1. Detecting the failure

Route poisoning begins when a router determines that a destination is no longer reachable. The destination might be:

A network directly connected to the router whose interface or link has failed
A route previously learned from another router
A route that has become invalid because of protocol timer or neighbor failure detection

2. Invalidating the local route

The detecting router invalidates or removes the usable route from its local forwarding and routing information. It must not continue forwarding packets using the failed path.

3. Advertising the unreachable metric

The router sends an update identifying the failed destination prefix and assigning the protocol's infinite metric. This update tells neighbors that the route is unreachable.

4. Sending a triggered update

Distance-vector protocols usually send periodic updates. Waiting for the next periodic update can delay convergence, so a topology change can cause a triggered update: an update sent in response to the change rather than only on the normal schedule.

A triggered update allows neighboring routers to receive the withdrawal sooner. The exact timing, suppression rules, and retransmission behavior depend on the routing protocol.

How Receiving Routers Process a Poisoned Route

When a neighboring router receives a destination with the infinite metric, it treats that destination as unreachable through the advertising router. It should not install the destination as a usable route with that neighbor as the next hop.

The receiving router may mark the route invalid temporarily as part of protocol timer behavior, or it may remove the route from its active routing table. The exact display depends on the protocol and implementation. In either case, the route is not usable for forwarding.

The receiving router can then advertise the unreachable information to other neighbors according to the protocol's rules. This propagation withdraws the failed destination throughout the distance-vector domain.

Infinite Metrics and RIP

An infinite metric is protocol-specific. Not every distance-vector protocol uses the same numeric value or even the same type of metric.

RIP, or Routing Information Protocol, uses hop count as its path metric. A hop is a router crossed on the path to a destination.

RIP metric range	Reachability status	Meaning
1 through 15	Reachable	Valid RIP hop-count values for usable routes
16	Unreachable	RIP's infinite metric; the destination must not be used

Therefore, a RIP router poisons a failed route by advertising it with metric 16. Do not generalize this number to all distance-vector protocols. The meaning of infinity must always be interpreted according to the protocol in use.

Two-Router RIP Topology Walkthrough

Consider this topology:

R1 is connected to R2.
R2 has direct connectivity to 10.0.0.0/24.
R2 advertises 10.0.0.0/24 to R1 using RIP.

Initially, R2 has a usable route to the prefix. R1 learns the prefix from R2 and installs R2 as its next hop.

R1 -------- R2 -------- 10.0.0.0/24
             directly connected

R1 routing table:
10.0.0.0/24  via R2  RIP metric 1

The precise displayed metric depends on the topology and implementation, but the important point is that R1 has a valid RIP-learned route through R2.

Failure sequence

The connection between R2 and 10.0.0.0/24 fails.
R2 detects the loss and invalidates its route to the prefix.
R2 sends a RIP update identifying 10.0.0.0/24 with metric 16.
R1 receives the update and treats the destination as unreachable through R2.
R1 withdraws the route from its usable forwarding information, or retains it temporarily only as an invalid route according to RIP timer behavior.

Step	Router	Event	Route status or advertised metric
1	R2 to R1	Initial route advertisement	`10.0.0.0/24` is reachable with a valid metric, such as 1
2	R2	Direct connectivity fails	The formerly connected route is no longer reachable
3	R2	Local route invalidation	R2 stops using the failed route
4	R2 to R1	Poisoned RIP advertisement	`10.0.0.0/24` is advertised with metric 16
5	R1	Withdrawal processing	R1 marks the route unreachable or removes it from the usable routing table

Normal versus poisoned RIP updates

Update type	Destination	Metric	Receiver's interpretation
Normal update	Reachable prefix	1 through 15	The prefix can be used if it is the best valid route
Poisoned update	Failed prefix	16	The prefix is unreachable through that advertisement

Route Poisoning Compared with Related Mechanisms

These mechanisms address related problems, but they are not interchangeable.

Mechanism	Primary action	When it applies	How it relates to route poisoning
Route poisoning	Advertises a failed destination with the infinite metric	After a route becomes unreachable	Explicitly withdraws the failed destination from neighbors
Split horizon	Suppresses advertisements back through the interface from which a route was learned	During normal distance-vector advertisements	Prevents a router from sending a learned route back toward its source; it does not advertise a failed destination with infinity
Poison reverse	Sends a learned route back toward its source with the infinite metric	When advertising routes to the neighbor from which they were learned	It is a specific reverse advertisement rule, whereas route poisoning announces that a destination has failed
Hold-down timer	Temporarily limits acceptance of potentially incorrect replacement information	After a route failure or suspected failure	Helps prevent premature acceptance of stale or unstable information while convergence occurs

These protections can work together. Route poisoning communicates the failure, split horizon limits misleading reverse advertisements, poison reverse explicitly marks certain reverse paths as unreachable, and hold-down timers provide time-based resistance to incorrect updates.

Optional Cisco IOS-Style RIP Lab

The following simplified configuration illustrates a lab in which R1 learns 10.0.0.0/24 from R2. Replace the example network statements with the actual addresses used in your lab.

! R1
router rip
 version 2
 no auto-summary
 network <R1-inter-router-network>

! R2
router rip
 version 2
 no auto-summary
 network <R2-inter-router-network>
 network 10.0.0.0

! On R2, simulate failure of the interface connected to 10.0.0.0/24
interface <R2-interface-to-10.0.0.0/24>
 shutdown

Use version 2 when the lab requires classless prefix behavior. Disable automatic summarization when the design requires the exact prefix 10.0.0.0/24 to be advertised.

Verification commands

show ip route
show ip route rip
show ip protocols
show ip rip database
debug ip rip
show ip interface brief

Before the failure, R1 should have a RIP-learned route for 10.0.0.0/24. During the failure event, RIP debugging or update information may show the prefix with metric 16. After R1 processes the withdrawal, it should no longer have a usable RIP route to that failed prefix.

Troubleshooting Route Poisoning

A route still appears after the directly connected network fails

Check whether the route is usable, marked invalid, or retained temporarily because of RIP timers.
Check whether another neighbor still advertises a valid path to the same prefix.
Inspect the route source, next hop, and RIP database.

The likely explanation is timer behavior during convergence or the presence of another valid path.

Metric 16 is not visible in the routing table

Use RIP debugging or the RIP database to inspect update contents.
Remember that an unreachable advertisement is an update message, not necessarily a normal installed forwarding entry.

A router may process the poison advertisement and remove the route from its active routing table, so the routing table may not display a persistent metric-16 entry.

Another router continues advertising a stale path

Review neighbor advertisements, next hops, and route sources.
Check split-horizon, poison-reverse, and hold-down behavior.
Confirm that all routers participate in the same RIP domain and use compatible settings.

Route poisoning reduces stale reachability, but convergence across several routers can involve multiple updates and loop-prevention mechanisms.

RIP neighbors do not exchange the expected route

Confirm interface addressing and Layer 3 reachability.
Verify that RIP is enabled on the intended interfaces or network statements.
Check RIP version compatibility and passive-interface settings.
Look for filtering that blocks RIP updates or the advertised prefix.

This usually indicates a neighbor or update-exchange configuration problem rather than a route-poisoning problem.

Exam-Relevant Summary

Route poisoning is a distance-vector loop-prevention technique.
A router advertises a failed destination with the protocol's infinite metric.
RIP uses hop count as its metric.
For RIP, metrics 1 through 15 represent reachable routes, while metric 16 means unreachable.
A poisoned update can be sent as a triggered update instead of waiting for the next periodic update.
The receiving router treats the destination as unreachable and does not forward traffic toward the advertising router using that route.
Split horizon suppresses certain advertisements; poison reverse advertises a learned route back to its source with infinity; hold-down timers limit acceptance of questionable replacement information.
Route poisoning is one part of broader distance-vector convergence and loop prevention.

For a concise reference, see Route Poisoning Explained.