Overview/Features/Routing & asymmetry
Routing & asymmetryDoes it come back
the way it went out?
The two-ended question no single-ended tool can answer. PathMRI traces both legs, compares them, and tells you whether a stateful firewall is sitting on exactly one of them — which is the quiet cause of connections that establish and then die.
Three questions, three checks
Did the devices change?
Membership is compared as a set of device identities, so a firewall answering on a new interface address is still the same firewall. A device leaving the path is security-relevant; one entering it is a policy change away from an outage.
Does the host still send traffic there?
Compared per prefix, ignoring the churn of routes that can never carry transit. A default gateway change is always high severity, and a new, more specific route that steals a tracked destination away from a firewall is flagged as security-relevant.
Do both legs agree?
Both directions are traced and compared. The verdict depends on what kind of device diverges, because a stateless filter on one leg is usually harmless and a stateful one never is.
The verdict says how much to worry
| Verdict | When | Severity |
|---|---|---|
| Asymmetric · stateful drop | A stateful firewall is on exactly one leg — it sees one direction only and will drop the other out of state | High |
| Asymmetric routing | The diverging firewall's statefulness is not known | Warn |
| Asymmetric · stateless | Only stateless filters diverge, such as a NACL or a stateless rule group — probably benign | Info |
| Asymmetric routing | Only routers and switches diverge, with no filtering device involved | Warn |
Confirmation before accusation
ECMP is not a finding
Equal-cost paths legitimately vary run to run, so a divergence must appear in every return observation before it is reported, and a device's absence has to hold across all of them.
A tunnel is not divergence
A tunnelled flow's endpoints are folded together, because tunnel opacity is not a difference in path — unless the two ends are identified and genuinely different, which is a real failover.
No red flag on an innocent hop
A confirmed, full-path stateful finding takes ownership of the diagnosis and clears the hop marker. Leaving a hop pinned would blame a gateway that did nothing wrong.