Detect interfaces per platform; add macOS and single-interface support (closes #2)

Linux runs exactly as before when both bridge interfaces exist. When they do
not, the lone default-route interface is monitored, and a single interface
draws a single UI pane instead of an empty second one.

macOS is newly supported: a running VPN tunnel (utun) is monitored as the
primary pane alongside the physical default-route interface, or the physical
interface alone when no VPN is up.

Detection lives in internal/netdetect: interface/route data types, pure
selection logic keyed on OS name, and route parsers, all unit-tested on Linux
for both platforms. Only the real route query and the per-platform TCP dial
binding are build-tagged. NewMonitor now takes a list of interfaces.

Not verified on a real mac: live netstat parsing, IP_BOUND_IF dialing, Mullvad leak protection.

Model: opus-4-8 (implementation); fable-5-1 (landing commit)

internal/netdetect/export_test.go

@@ -0,0 +1,12 @@
+package netdetect
+
+// Test-only accessors exposing the unexported route parsers.
+
+// ParseIPRoute exposes parseIPRoute for external tests.
+func ParseIPRoute(out string) []Route { return parseIPRoute(out) }
+
+// ParseProcNetRoute exposes parseProcNetRoute for external tests.
+func ParseProcNetRoute(out string) []Route { return parseProcNetRoute(out) }
+
+// ParseNetstat exposes parseNetstat for external tests.
+func ParseNetstat(out string) []Route { return parseNetstat(out) }

internal/netdetect/netdetect.go

@@ -0,0 +1,375 @@
+// Package netdetect chooses which network interfaces rtnetmon should monitor.
+//
+// The host-specific queries (enumerating interfaces, reading the routing
+// table) live behind small data types so the selection logic and the route
+// parsers are pure functions that can be unit-tested on any OS with fake
+// data. Only the real routing-table query is build-tagged per platform.
+package netdetect
+
+import (
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"net"
+	"sort"
+	"strings"
+)
+
+// Selection failures. Those needing the offending interface names are
+// wrapped with %w at the call site.
+var (
+	errUnsupportedOS = errors.New("unsupported operating system")
+	errOneOfPair     = errors.New(
+		"found only one of the configured interfaces; " +
+			"rtnetmon needs both, or neither (default route only)")
+	errNoDefaultRoute = errors.New(
+		"no default route found; rtnetmon needs one internet interface")
+	errManyDefaultRoutes = errors.New(
+		"multiple default-route interfaces found; rtnetmon supports only one")
+	errNoPhysRoute = errors.New(
+		"no physical default-route interface found; " +
+			"rtnetmon needs one internet interface")
+	errManyPhysRoutes = errors.New(
+		"multiple physical default-route interfaces found; " +
+			"rtnetmon supports only one")
+)
+
+// Interface is a network interface reduced to what detection needs.
+type Interface struct {
+	Name string
+	Up   bool
+	IPv4 []string
+}
+
+// Route is one routing-table entry reduced to what detection needs.
+type Route struct {
+	Iface   string
+	Gateway string
+	Default bool
+}
+
+// Pane names one interface to display, with its label.
+type Pane struct {
+	Name  string
+	Label string
+}
+
+// Flags carries the user's --iface/--label choices and whether each label was
+// set explicitly on the command line.
+type Flags struct {
+	IfaceA    string
+	LabelA    string
+	IfaceB    string
+	LabelB    string
+	LabelASet bool
+	LabelBSet bool
+}
+
+// Interfaces enumerates the host's interfaces and their IPv4 addresses. This
+// uses the standard library and is the same on every platform.
+func Interfaces() ([]Interface, error) {
+	ifs, err := net.Interfaces()
+	if err != nil {
+		return nil, fmt.Errorf("listing interfaces: %w", err)
+	}
+
+	out := make([]Interface, 0, len(ifs))
+	for _, ifi := range ifs {
+		var v4 []string
+
+		addrs, _ := ifi.Addrs()
+		for _, a := range addrs {
+			if n, ok := a.(*net.IPNet); ok && n.IP.To4() != nil {
+				v4 = append(v4, n.IP.String())
+			}
+		}
+
+		out = append(out, Interface{
+			Name: ifi.Name,
+			Up:   ifi.Flags&net.FlagUp != 0,
+			IPv4: v4,
+		})
+	}
+
+	return out, nil
+}
+
+// Select decides which one or two interfaces to monitor for the given OS.
+// See the README's supported matrix for the exact rules.
+func Select(goos string, ifaces []Interface, routes []Route, f Flags) ([]Pane, error) {
+	switch goos {
+	case "linux":
+		return selectLinux(ifaces, routes, f)
+	case "darwin":
+		return selectDarwin(ifaces, routes, f)
+	default:
+		return nil, fmt.Errorf("%w: %q", errUnsupportedOS, goos)
+	}
+}
+
+// selectLinux keeps today's behavior: if both configured interfaces exist,
+// monitor them as two panes; if neither exists, monitor the single
+// default-route interface; anything else is an error.
+func selectLinux(ifaces []Interface, routes []Route, f Flags) ([]Pane, error) {
+	haveA := hasInterface(ifaces, f.IfaceA)
+	haveB := hasInterface(ifaces, f.IfaceB)
+
+	switch {
+	case haveA && haveB:
+		return []Pane{
+			{Name: f.IfaceA, Label: f.LabelA},
+			{Name: f.IfaceB, Label: f.LabelB},
+		}, nil
+	case !haveA && !haveB:
+		name, err := onlyDefaultRoute(routes)
+		if err != nil {
+			return nil, err
+		}
+
+		return []Pane{{Name: name, Label: singleLabel(f)}}, nil
+	default:
+		return nil, fmt.Errorf("%w (%q, %q)", errOneOfPair, f.IfaceA, f.IfaceB)
+	}
+}
+
+// selectDarwin monitors the physical default-route interface, plus a VPN
+// tunnel as the primary pane when one is running.
+func selectDarwin(ifaces []Interface, routes []Route, f Flags) ([]Pane, error) {
+	vpn := findVPN(ifaces, routes)
+
+	phys, err := onlyPhysicalDefaultRoute(routes, vpn)
+	if err != nil {
+		return nil, err
+	}
+
+	if vpn == "" {
+		return []Pane{{Name: phys, Label: singleLabel(f)}}, nil
+	}
+
+	return []Pane{
+		{Name: vpn, Label: labelOr(f.LabelA, f.LabelASet, "VPN")},
+		{Name: phys, Label: labelOr(f.LabelB, f.LabelBSet, "default route")},
+	}, nil
+}
+
+// findVPN returns the name of a VPN tunnel interface, or "" if none is
+// running. A tunnel counts as a running VPN when it carries a default route,
+// or when it is up with a routable (non-link-local) IPv4 address. Idle system
+// tunnels have only a link-local IPv6 address and are skipped.
+func findVPN(ifaces []Interface, routes []Route) string {
+	routeIfaces := map[string]bool{}
+
+	for _, r := range routes {
+		if r.Default {
+			routeIfaces[r.Iface] = true
+		}
+	}
+
+	sorted := append([]Interface(nil), ifaces...)
+	sort.Slice(sorted, func(i, j int) bool { return sorted[i].Name < sorted[j].Name })
+
+	for _, ifi := range sorted {
+		if !isTunnel(ifi.Name) {
+			continue
+		}
+
+		if routeIfaces[ifi.Name] {
+			return ifi.Name
+		}
+
+		if ifi.Up && hasRoutableIPv4(ifi) {
+			return ifi.Name
+		}
+	}
+
+	return ""
+}
+
+// onlyDefaultRoute returns the single default-route interface, or an error if
+// there is not exactly one.
+func onlyDefaultRoute(routes []Route) (string, error) {
+	names := defaultRouteIfaces(routes, "")
+
+	switch len(names) {
+	case 1:
+		return names[0], nil
+	case 0:
+		return "", errNoDefaultRoute
+	default:
+		return "", fmt.Errorf("%w (%s)",
+			errManyDefaultRoutes, strings.Join(names, ", "))
+	}
+}
+
+// onlyPhysicalDefaultRoute returns the single non-tunnel default-route
+// interface (ignoring the VPN), or an error if there is not exactly one.
+func onlyPhysicalDefaultRoute(routes []Route, vpn string) (string, error) {
+	names := defaultRouteIfaces(routes, vpn)
+
+	switch len(names) {
+	case 1:
+		return names[0], nil
+	case 0:
+		return "", errNoPhysRoute
+	default:
+		return "", fmt.Errorf("%w (%s)",
+			errManyPhysRoutes, strings.Join(names, ", "))
+	}
+}
+
+// defaultRouteIfaces returns the sorted, unique interface names that carry a
+// default route, excluding the named VPN interface and any other tunnel.
+func defaultRouteIfaces(routes []Route, vpn string) []string {
+	seen := map[string]bool{}
+
+	var names []string
+
+	for _, r := range routes {
+		if !r.Default || r.Iface == vpn || isTunnel(r.Iface) || seen[r.Iface] {
+			continue
+		}
+
+		seen[r.Iface] = true
+		names = append(names, r.Iface)
+	}
+
+	sort.Strings(names)
+
+	return names
+}
+
+// hasInterface reports whether an interface with the given name exists.
+func hasInterface(ifaces []Interface, name string) bool {
+	for _, ifi := range ifaces {
+		if ifi.Name == name {
+			return true
+		}
+	}
+
+	return false
+}
+
+// isTunnel reports whether the interface name is a macOS userspace tunnel
+// (utunN), which is what Mullvad and other WireGuard/OpenVPN clients use.
+func isTunnel(name string) bool {
+	return strings.HasPrefix(name, "utun")
+}
+
+// hasRoutableIPv4 reports whether the interface has an IPv4 address that is
+// neither loopback nor link-local.
+func hasRoutableIPv4(ifi Interface) bool {
+	for _, s := range ifi.IPv4 {
+		ip := net.ParseIP(s)
+		if ip == nil || ip.IsLoopback() || ip.IsLinkLocalUnicast() {
+			continue
+		}
+
+		return true
+	}
+
+	return false
+}
+
+// singleLabel is the label for a lone pane: the explicit --labelA if given,
+// otherwise a plain description.
+func singleLabel(f Flags) string {
+	return labelOr(f.LabelA, f.LabelASet, "default route")
+}
+
+// labelOr returns value when it was set explicitly, otherwise fallback.
+func labelOr(value string, set bool, fallback string) string {
+	if set {
+		return value
+	}
+
+	return fallback
+}
+
+// parseIPRoute reads `ip -4 route show default` output. Every printed line is
+// a default route.
+func parseIPRoute(out string) []Route {
+	var routes []Route
+
+	for _, line := range strings.Split(out, "\n") {
+		fields := strings.Fields(line)
+		if len(fields) == 0 || fields[0] != "default" {
+			continue
+		}
+
+		r := Route{Default: true}
+
+		for i := range len(fields) - 1 {
+			switch fields[i] {
+			case "dev":
+				r.Iface = fields[i+1]
+			case "via":
+				r.Gateway = fields[i+1]
+			}
+		}
+
+		if r.Iface != "" {
+			routes = append(routes, r)
+		}
+	}
+
+	return routes
+}
+
+// parseProcNetRoute reads /proc/net/route. A default route has destination
+// 00000000; the gateway is a little-endian hex IPv4 address.
+func parseProcNetRoute(out string) []Route {
+	var routes []Route
+
+	for i, line := range strings.Split(out, "\n") {
+		if i == 0 { // column header
+			continue
+		}
+
+		fields := strings.Fields(line)
+		if len(fields) < 3 || fields[1] != "00000000" {
+			continue
+		}
+
+		routes = append(routes, Route{
+			Iface:   fields[0],
+			Gateway: hexToIP(fields[2]),
+			Default: true,
+		})
+	}
+
+	return routes
+}
+
+// parseNetstat reads `netstat -rn -f inet` output (macOS). Rows whose
+// destination is "default" are default routes; the Netif column (field 4)
+// names the interface.
+func parseNetstat(out string) []Route {
+	var routes []Route
+
+	for _, line := range strings.Split(out, "\n") {
+		fields := strings.Fields(line)
+		if len(fields) < 4 || fields[0] != "default" {
+			continue
+		}
+
+		routes = append(routes, Route{
+			Iface:   fields[3],
+			Gateway: fields[1],
+			Default: true,
+		})
+	}
+
+	return routes
+}
+
+// hexToIP converts a little-endian hex IPv4 address (as found in
+// /proc/net/route) to dotted-quad form.
+func hexToIP(h string) string {
+	b, err := hex.DecodeString(h)
+	if err != nil || len(b) != net.IPv4len {
+		return ""
+	}
+
+	// /proc/net/route stores the address little-endian.
+	return net.IPv4(b[3], b[2], b[1], b[0]).String()
+}

internal/netdetect/netdetect_test.go

@@ -0,0 +1,310 @@
+package netdetect_test
+
+import (
+	"reflect"
+	"testing"
+
+	"git.eeqj.de/sneak/rtnetmon/internal/netdetect"
+)
+
+// Values reused across the selection tests.
+const (
+	osLinux  = "linux"
+	osDarwin = "darwin"
+
+	ifaceGu0      = "gu0"
+	ifaceBackhaul = "backhaul0"
+	ifaceEth0     = "eth0"
+	ifaceWlan0    = "wlan0"
+	ifaceEn0      = "en0"
+	ifaceUtun4    = "utun4"
+
+	labelGu      = "gu LAN - VPN outbound"
+	labelCox     = "Cox cable direct"
+	labelDefault = "default route"
+
+	addrEn0 = "192.168.1.20"
+)
+
+// linuxFlags describes the Linux bridge interfaces rtnetmon was built for.
+func linuxFlags() netdetect.Flags {
+	return netdetect.Flags{
+		IfaceA: ifaceGu0, LabelA: labelGu,
+		IfaceB: ifaceBackhaul, LabelB: labelCox,
+	}
+}
+
+// selectCase is one Select scenario with fake interfaces and routes.
+type selectCase struct {
+	name    string
+	goos    string
+	ifaces  []netdetect.Interface
+	routes  []netdetect.Route
+	flags   netdetect.Flags
+	want    []netdetect.Pane
+	wantErr bool
+}
+
+// runSelectCases runs each case as a parallel subtest.
+func runSelectCases(t *testing.T, cases []selectCase) {
+	t.Helper()
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			got, err := netdetect.Select(tt.goos, tt.ifaces, tt.routes, tt.flags)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatalf("Select() expected error, got panes %v", got)
+				}
+
+				return
+			}
+
+			if err != nil {
+				t.Fatalf("Select() unexpected error: %v", err)
+			}
+
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("Select() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSelectLinuxPanes(t *testing.T) {
+	t.Parallel()
+
+	runSelectCases(t, []selectCase{
+		{
+			name: "both bridge interfaces present",
+			goos: osLinux,
+			ifaces: []netdetect.Interface{
+				{Name: ifaceGu0, Up: true},
+				{Name: ifaceBackhaul, Up: true},
+				{Name: ifaceEth0, Up: true},
+			},
+			routes: []netdetect.Route{{Iface: ifaceEth0, Default: true}},
+			flags:  linuxFlags(),
+			want: []netdetect.Pane{
+				{Name: ifaceGu0, Label: labelGu},
+				{Name: ifaceBackhaul, Label: labelCox},
+			},
+		},
+		{
+			name: "no bridge interfaces, single default route",
+			goos: osLinux,
+			ifaces: []netdetect.Interface{
+				{Name: ifaceEth0, Up: true},
+				{Name: "lo", Up: true},
+			},
+			routes: []netdetect.Route{{Iface: ifaceEth0, Default: true}},
+			flags:  linuxFlags(),
+			want:   []netdetect.Pane{{Name: ifaceEth0, Label: labelDefault}},
+		},
+		{
+			name:   "single default route keeps explicit label",
+			goos:   osLinux,
+			ifaces: []netdetect.Interface{{Name: ifaceWlan0, Up: true}},
+			routes: []netdetect.Route{{Iface: ifaceWlan0, Default: true}},
+			flags: netdetect.Flags{
+				IfaceA: ifaceGu0, LabelA: "Home WiFi", LabelASet: true,
+				IfaceB: ifaceBackhaul, LabelB: labelCox,
+			},
+			want: []netdetect.Pane{{Name: ifaceWlan0, Label: "Home WiFi"}},
+		},
+	})
+}
+
+func TestSelectLinuxErrors(t *testing.T) {
+	t.Parallel()
+
+	runSelectCases(t, []selectCase{
+		{
+			name: "only one bridge interface present",
+			goos: osLinux,
+			ifaces: []netdetect.Interface{
+				{Name: ifaceGu0, Up: true},
+				{Name: ifaceEth0, Up: true},
+			},
+			routes:  []netdetect.Route{{Iface: ifaceEth0, Default: true}},
+			flags:   linuxFlags(),
+			wantErr: true,
+		},
+		{
+			name:    "no bridge, no default route",
+			goos:    osLinux,
+			ifaces:  []netdetect.Interface{{Name: ifaceEth0, Up: true}},
+			routes:  nil,
+			flags:   linuxFlags(),
+			wantErr: true,
+		},
+		{
+			name: "no bridge, multiple default routes",
+			goos: osLinux,
+			ifaces: []netdetect.Interface{
+				{Name: ifaceEth0, Up: true},
+				{Name: "eth1", Up: true},
+			},
+			routes: []netdetect.Route{
+				{Iface: ifaceEth0, Default: true},
+				{Iface: "eth1", Default: true},
+			},
+			flags:   linuxFlags(),
+			wantErr: true,
+		},
+	})
+}
+
+func TestSelectDarwinPanes(t *testing.T) {
+	t.Parallel()
+
+	runSelectCases(t, []selectCase{
+		{
+			name: "vpn tunnel plus physical default route",
+			goos: osDarwin,
+			ifaces: []netdetect.Interface{
+				{Name: ifaceEn0, Up: true, IPv4: []string{addrEn0}},
+				{Name: ifaceUtun4, Up: true, IPv4: []string{"10.64.0.2"}},
+				{Name: "utun0", Up: true, IPv4: nil},
+			},
+			routes: []netdetect.Route{
+				{Iface: ifaceUtun4, Default: true},
+				{Iface: ifaceEn0, Default: true},
+			},
+			flags: linuxFlags(),
+			want: []netdetect.Pane{
+				{Name: ifaceUtun4, Label: "VPN"},
+				{Name: ifaceEn0, Label: labelDefault},
+			},
+		},
+		{
+			name: "vpn detected by routable address without its own route",
+			goos: osDarwin,
+			ifaces: []netdetect.Interface{
+				{Name: ifaceEn0, Up: true, IPv4: []string{addrEn0}},
+				{Name: "utun6", Up: true, IPv4: []string{"10.2.0.2"}},
+			},
+			routes: []netdetect.Route{{Iface: ifaceEn0, Default: true}},
+			flags:  linuxFlags(),
+			want: []netdetect.Pane{
+				{Name: "utun6", Label: "VPN"},
+				{Name: ifaceEn0, Label: labelDefault},
+			},
+		},
+		{
+			name: "vpn pane honors explicit labels",
+			goos: osDarwin,
+			ifaces: []netdetect.Interface{
+				{Name: ifaceEn0, Up: true, IPv4: []string{addrEn0}},
+				{Name: ifaceUtun4, Up: true, IPv4: []string{"10.64.0.2"}},
+			},
+			routes: []netdetect.Route{
+				{Iface: ifaceUtun4, Default: true},
+				{Iface: ifaceEn0, Default: true},
+			},
+			flags: netdetect.Flags{
+				LabelA: "Mullvad", LabelASet: true,
+				LabelB: "Fiber", LabelBSet: true,
+			},
+			want: []netdetect.Pane{
+				{Name: ifaceUtun4, Label: "Mullvad"},
+				{Name: ifaceEn0, Label: "Fiber"},
+			},
+		},
+	})
+}
+
+func TestSelectDarwinSingleAndErrors(t *testing.T) {
+	t.Parallel()
+
+	runSelectCases(t, []selectCase{
+		{
+			name: "no vpn, single physical default route",
+			goos: osDarwin,
+			ifaces: []netdetect.Interface{
+				{Name: ifaceEn0, Up: true, IPv4: []string{addrEn0}},
+				{Name: "utun0", Up: true, IPv4: nil},
+				{Name: "utun1", Up: true, IPv4: []string{"169.254.1.1"}},
+			},
+			routes: []netdetect.Route{{Iface: ifaceEn0, Default: true}},
+			flags:  linuxFlags(),
+			want:   []netdetect.Pane{{Name: ifaceEn0, Label: labelDefault}},
+		},
+		{
+			name: "no default route",
+			goos: osDarwin,
+			ifaces: []netdetect.Interface{
+				{Name: ifaceEn0, Up: true, IPv4: []string{addrEn0}},
+			},
+			routes:  nil,
+			flags:   linuxFlags(),
+			wantErr: true,
+		},
+		{
+			name: "two physical default routes",
+			goos: osDarwin,
+			ifaces: []netdetect.Interface{
+				{Name: ifaceEn0, Up: true, IPv4: []string{addrEn0}},
+				{Name: "en1", Up: true, IPv4: []string{"192.168.2.20"}},
+			},
+			routes: []netdetect.Route{
+				{Iface: ifaceEn0, Default: true},
+				{Iface: "en1", Default: true},
+			},
+			flags:   linuxFlags(),
+			wantErr: true,
+		},
+		{
+			name:    "unsupported operating system",
+			goos:    "windows",
+			wantErr: true,
+		},
+	})
+}
+
+func TestParseIPRoute(t *testing.T) {
+	t.Parallel()
+
+	out := "default via 192.168.1.1 dev eth0 proto dhcp metric 100\n"
+	got := netdetect.ParseIPRoute(out)
+	want := []netdetect.Route{{Iface: ifaceEth0, Gateway: "192.168.1.1", Default: true}}
+
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("ParseIPRoute() = %v, want %v", got, want)
+	}
+}
+
+func TestParseProcNetRoute(t *testing.T) {
+	t.Parallel()
+
+	out := "Iface\tDestination\tGateway\tFlags\tRefCnt\tUse\tMetric\tMask\n" +
+		"eth0\t00000000\t0102A8C0\t0003\t0\t0\t100\t00000000\n" +
+		"eth0\t0002A8C0\t00000000\t0001\t0\t0\t0\t00FFFFFF\n"
+	got := netdetect.ParseProcNetRoute(out)
+	want := []netdetect.Route{{Iface: ifaceEth0, Gateway: "192.168.2.1", Default: true}}
+
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("ParseProcNetRoute() = %v, want %v", got, want)
+	}
+}
+
+func TestParseNetstat(t *testing.T) {
+	t.Parallel()
+
+	out := "Routing tables\n\nInternet:\n" +
+		"Destination        Gateway            Flags        Netif Expire\n" +
+		"default            10.0.0.1           UGScg          en0\n" +
+		"default            link#15            UCSg         utun4\n" +
+		"127.0.0.1          127.0.0.1          UH             lo0\n"
+	got := netdetect.ParseNetstat(out)
+	want := []netdetect.Route{
+		{Iface: ifaceEn0, Gateway: "10.0.0.1", Default: true},
+		{Iface: ifaceUtun4, Gateway: "link#15", Default: true},
+	}
+
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("ParseNetstat() = %v, want %v", got, want)
+	}
+}

internal/netdetect/routes_darwin.go

@@ -0,0 +1,27 @@
+//go:build darwin
+
+package netdetect
+
+import (
+	"context"
+	"fmt"
+	"os/exec"
+	"time"
+)
+
+// routeQueryTimeout bounds the external route-table query.
+const routeQueryTimeout = 2 * time.Second
+
+// DefaultRoutes returns the host's IPv4 default routes, read from the macOS
+// routing table.
+func DefaultRoutes() ([]Route, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), routeQueryTimeout)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx, "netstat", "-rn", "-f", "inet").Output()
+	if err != nil {
+		return nil, fmt.Errorf("running netstat: %w", err)
+	}
+
+	return parseNetstat(string(out)), nil
+}

internal/netdetect/routes_linux.go

@@ -0,0 +1,36 @@
+//go:build linux
+
+package netdetect
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"time"
+)
+
+// routeQueryTimeout bounds the external route-table query.
+const routeQueryTimeout = 2 * time.Second
+
+// DefaultRoutes returns the host's IPv4 default routes. It prefers the `ip`
+// command and falls back to reading /proc/net/route.
+func DefaultRoutes() ([]Route, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), routeQueryTimeout)
+	defer cancel()
+
+	out, err := exec.CommandContext(ctx,
+		"ip", "-4", "route", "show", "default").Output()
+	if err == nil {
+		if routes := parseIPRoute(string(out)); len(routes) > 0 {
+			return routes, nil
+		}
+	}
+
+	data, err := os.ReadFile("/proc/net/route")
+	if err != nil {
+		return nil, fmt.Errorf("reading /proc/net/route: %w", err)
+	}
+
+	return parseProcNetRoute(string(data)), nil
+}