When a Linux host sends traffic to a destination that does not match a more specific route, the kernel falls back to the default route. Checking that path quickly shows which gateway and interface carry package downloads, API calls, VPN traffic, and other outbound connections.
Linux stores route entries in kernel routing tables, and the routing policy database can direct traffic to a table other than main before the normal lookup happens. ip route show default prints the configured default path, while ip route get asks the kernel which next hop, interface, and source address it would actually use for a real destination.
On most current Linux distributions, these lookups work the same way because iproute2 is part of the base networking toolset. VPN clients, multiple uplinks, and custom policy rules can still send traffic somewhere else before the main table is consulted, so ip rule show is the next check when the selected path does not match the gateway or interface that was expected.
Related: How to troubleshoot a Linux network outage
Related: How to add a static route in Linux
$ ip route show default default via 192.0.2.1 dev eth0 proto dhcp src 192.0.2.40 metric 100
This output shows the configured next hop after via and the outgoing interface after dev. If more than one default route appears in the main table, the entry with the lower metric is preferred unless policy rules send the lookup to another table.
$ ip route get 203.0.113.50
203.0.113.50 via 192.0.2.1 dev eth0 src 192.0.2.40 uid 1000
cache
This lookup reflects the route Linux would actually use for that destination, including the chosen next hop, interface, and source address. Using a numeric IP keeps DNS delays or resolver failures from obscuring the route check.
$ ip rule show 0: from all lookup local 32766: from all lookup main 32767: from all lookup default
Lower rule numbers run first, so any rule below 32766 can direct traffic to a different table before the main default route is considered. Check ip -6 route show default separately when IPv6 traffic matters because IPv4 and IPv6 default routes are maintained independently.