How does Windows Recover from "ROUTE /F"?

Question

We all know about the ROUTE /F command in Windows which, according to its documentation:

"Clears the routing tables of all gateway entries. If this is used in conjunction with one of the commands, the tables are cleared prior to running the command."

If you notice the careful phrasing, it doesn't clear the routing table of all entries but rather all gateway entries. Tiny but significant distinction but this is not really what my question is about. My question is about what happens right after reboot:

You issue "ROUTE /F", you verify via "ROUTE PRINT" that indeed all gateway entries were deleted from the routing table, but then after you reboot, the original routing table is magically restored, as if "ROUTE /F" were never issued.

My question is: How does Windows know where to take these values from? Are they stored somewhere in the registry? If so, where are they stored?

Solution

Is the computer connected to a network with a router? Usually the computer will send out a DHCP query when it activates the network card which will request the Gateway, Subnet, and an IP from the router. Try disconnecting the computer from the network and then run route /F and reboot the machine.

Comments

[Android Eve]

Yes, it is connected to a network with a router. Unfortunately I am not near a computer with which I can experiment, so I'll report back the result of the test when I can. In the meanwhile, if there is some formal documentation on the subject (i.e. not just empirical) this would be most helpful.

[user1984103]

Read up on the DHCP protocol. When windows (or linux with dhcp-client, or OS X) brings up a network interface, it sends out a query and waits for a response. Even if it cached the returned values in the registry, there is absolutely no guarantee that any of them will still be valid due to the highly dynamic nature of networks, so it does not bother to store them for the purpose of reuse. Upon receiving a DHCP response, the system will modify the routing table to provide internet access. You might wan to also look at static routes, or routes that persist over reboots.

[LawrenceC]

Don't forget that directly connected interfaces provide an automatic route by virtue of the subnet mask, i.e. if an interface is assigned 10.1.0.1/255.255.255.0, then automatically 10.1.0.X should be accessible through it since it's the same subnet, these are directly connected routes.