Linux Route Check

Project Notes

There are lots of additions I would like to make such as wildcards, and subnet masks. I also want to add to the input checks to make sure everything is kosher before it runs. This is in production in our network currently and the functionality is there.
Here is a synopsis from the --help flag (brief version from -h)
---------------------
This check is able to look at your routing table and search for items you select. It was built for the netstat command in Linux and may need some modification to work with other operating systems.

Currently this software is limited to checking IPv4 routes only. I don't currently have a plan to add in IPv6

Usage: check_route -(cr) -n [COUNT] -d [DESTINATION IP] -s [SOURCE IP] -g [GATEWAY] -m [MASK] -f [INTERFACE]

Options:
-c Use the routing cache instead of the static rout table
-d [DESTINATION IP] Destination ip address of the route
-i [INTERFACE] interface of the route
-g [GATEWAY] gateway of the route
-h Print the help menu
--help Print the entire help page with examples
-L Used with -n to give allowances for "Less Than"
-M Used with -n to give allowances for "More Than"
-m [MASK] network mask of the route (Cannot be used with -c)
-n [COUNT] Number of routes it should find (default is 1)
-s [SOURCE IP] Source IP address (for use only with the -c flag)

To reverse the command (crit if the route exists) just use "-n 0"

At a minimum at least one of the -f, -g, -i or -m flags with their appropriate definitions are required. You can put in multiple definitions such as -d 10.0.0.1 -g 1.2.3.4 and it will only look for routes where both items are true.

EXAMPLES:

check_route -d 10.0.0.1 -g 0.0.0.0

A simple check to make sure you have a default route set up correctly. This is good to use by itself (as long as nagios is on the same network) but even better in conjunction with puppet when you're using multiple default routes and need to make sure each machine is going to the correct place.

check_route -d 192.168.1.1 -n 0

This will make sure a route does not exist. It's very useful when moving a device to a new network and you need to make sure the old routes no longer exist.

check_route -i eth3 -M -n 5

This will be ok as long as there are move than 5 routes on eth3.

check_route -c -L -n 1000 -i eth2

This command will look in your dynamic route cache instead of your static routing table. It will go critical if more than 1000 routes are created to eth2. This command is a crude way of detecting a DDOS attack.

check_route -c -M -n 0 -i eth1

This command is great for passively tracking performance data. You can see what routes are being added or deleted from an interface.