Routing

The routing table decides which interface traffic leaves by. A new default route can move everything your machine does onto a different path without anything else visibly changing.

What GURDN observes

The routing table, joined to the interface list, so the active path can be named rather than inferred. Route changes are among the surfaces Windows notifies on, so they are observed promptly rather than on a poll.

Ambiguity is reported, not resolved

When several interfaces carry a default route, GURDN reports that the attribution is ambiguous instead of picking the one that looks most likely. Metric and interface order make a guess possible, and a guess presented as an observation is the kind of small dishonesty that makes everything else in a security product harder to believe.

Routing is observation only

GURDN does not add, remove or reorder routes. Routing is where a mistake takes a machine off the network entirely, including the path an administrator would use to fix it, and the product has no response that justifies that risk.

What routing contributes is context. A resolver change on a network GURDN has seen before is ordinary. The same change arriving with a moved default route and a new adapter is not, and routing is what distinguishes the two. See network observation.