diff --git a/src/detection/localip/localip.h b/src/detection/localip/localip.h
index 6fea95a79..8d0fe84bf 100644
--- a/src/detection/localip/localip.h
+++ b/src/detection/localip/localip.h
@@ -12,10 +12,6 @@ typedef struct FFLocalIpResult
     FFstrbuf ipv6;
     FFstrbuf mac;
     bool defaultRoute;
-
-    #ifdef _WIN32
-    uint32_t ifIndex;
-    #endif
 } FFLocalIpResult;
 
 const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results);
diff --git a/src/detection/localip/localip_linux.c b/src/detection/localip/localip_linux.c
index 233d42500..195ab2ae0 100644
--- a/src/detection/localip/localip_linux.c
+++ b/src/detection/localip/localip_linux.c
@@ -16,7 +16,7 @@
 #include <netpacket/packet.h>
 #endif
 
-static void addNewIp(FFlist* list, const char* name, const char* addr, int type)
+static void addNewIp(FFlist* list, const char* name, const char* addr, int type, bool defaultRoute)
 {
     FFLocalIpResult* ip = NULL;
 
@@ -33,7 +33,7 @@ static void addNewIp(FFlist* list, const char* name, const char* addr, int type)
         ffStrbufInit(&ip->ipv4);
         ffStrbufInit(&ip->ipv6);
         ffStrbufInit(&ip->mac);
-        ip->defaultRoute = false;
+        ip->defaultRoute = defaultRoute;
     }
 
     switch (type)
@@ -56,11 +56,17 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results)
     if(getifaddrs(&ifAddrStruct) < 0)
         return "getifaddrs(&ifAddrStruct) failed";
 
+    FF_STRBUF_AUTO_DESTROY defaultRouteIface = ffStrbufCreate();
+    ffNetifGetDefaultRoute(&defaultRouteIface);
+
     for (struct ifaddrs* ifa = ifAddrStruct; ifa; ifa = ifa->ifa_next)
     {
         if (!ifa->ifa_addr || !(ifa->ifa_flags & IFF_RUNNING))
             continue;
 
+        if (options->defaultRouteOnly && !ffStrbufEqualS(&defaultRouteIface, ifa->ifa_name))
+            continue;
+
         if ((ifa->ifa_flags & IFF_LOOPBACK) && !(options->showType & FF_LOCALIP_TYPE_LOOP_BIT))
             continue;
 
@@ -75,7 +81,7 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results)
             struct sockaddr_in* ipv4 = (struct sockaddr_in*) ifa->ifa_addr;
             char addressBuffer[INET_ADDRSTRLEN];
             inet_ntop(AF_INET, &ipv4->sin_addr, addressBuffer, INET_ADDRSTRLEN);
-            addNewIp(results, ifa->ifa_name, addressBuffer, AF_INET);
+            addNewIp(results, ifa->ifa_name, addressBuffer, AF_INET, ffStrbufEqualS(&defaultRouteIface, ifa->ifa_name));
         }
         else if (ifa->ifa_addr->sa_family == AF_INET6)
         {
@@ -85,7 +91,7 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results)
             struct sockaddr_in6* ipv6 = (struct sockaddr_in6 *)ifa->ifa_addr;
             char addressBuffer[INET6_ADDRSTRLEN];
             inet_ntop(AF_INET6, &ipv6->sin6_addr, addressBuffer, INET6_ADDRSTRLEN);
-            addNewIp(results, ifa->ifa_name, addressBuffer, AF_INET6);
+            addNewIp(results, ifa->ifa_name, addressBuffer, AF_INET6, ffStrbufEqualS(&defaultRouteIface, ifa->ifa_name));
         }
         #if defined(__FreeBSD__) || defined(__APPLE__)
         else if (ifa->ifa_addr->sa_family == AF_LINK)
@@ -97,7 +103,7 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results)
             uint8_t* ptr = (uint8_t*) LLADDR((struct sockaddr_dl *)ifa->ifa_addr);
             snprintf(addressBuffer, sizeof(addressBuffer), "%02x:%02x:%02x:%02x:%02x:%02x",
                         ptr[0], ptr[1], ptr[2], ptr[3], ptr[4], ptr[5]);
-            addNewIp(results, ifa->ifa_name, addressBuffer, -1);
+            addNewIp(results, ifa->ifa_name, addressBuffer, -1, ffStrbufEqualS(&defaultRouteIface, ifa->ifa_name));
         }
         #else
         else if (ifa->ifa_addr->sa_family == AF_PACKET)
@@ -109,18 +115,12 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results)
             uint8_t* ptr = ((struct sockaddr_ll *)ifa->ifa_addr)->sll_addr;
             snprintf(addressBuffer, sizeof(addressBuffer), "%02x:%02x:%02x:%02x:%02x:%02x",
                         ptr[0], ptr[1], ptr[2], ptr[3], ptr[4], ptr[5]);
-            addNewIp(results, ifa->ifa_name, addressBuffer, -1);
+            addNewIp(results, ifa->ifa_name, addressBuffer, -1, ffStrbufEqualS(&defaultRouteIface, ifa->ifa_name));
         }
         #endif
     }
 
     if (ifAddrStruct) freeifaddrs(ifAddrStruct);
 
-    FF_STRBUF_AUTO_DESTROY iface = ffStrbufCreate();
-    if (ffNetifGetDefaultRoute(&iface))
-    {
-        FF_LIST_FOR_EACH(FFLocalIpResult, ip, *results)
-            ip->defaultRoute = ffStrbufEqual(&ip->name, &iface);
-    }
     return NULL;
 }
diff --git a/src/detection/localip/localip_windows.c b/src/detection/localip/localip_windows.c
index 82323fd11..78552be5b 100644
--- a/src/detection/localip/localip_windows.c
+++ b/src/detection/localip/localip_windows.c
@@ -6,7 +6,7 @@
 #include "util/windows/unicode.h"
 #include "localip.h"
 
-static void addNewIp(FFlist* list, const char* name, const char* value, int type, bool newIp, uint32_t ifIndex)
+static void addNewIp(FFlist* list, const char* name, const char* value, int type, bool newIp, bool defaultRoute)
 {
     FFLocalIpResult* ip = NULL;
 
@@ -17,8 +17,7 @@ static void addNewIp(FFlist* list, const char* name, const char* value, int type
         ffStrbufInit(&ip->ipv4);
         ffStrbufInit(&ip->ipv6);
         ffStrbufInit(&ip->mac);
-        ip->defaultRoute = false;
-        ip->ifIndex = ifIndex;
+        ip->defaultRoute = defaultRoute;
     }
     else
     {
@@ -71,9 +70,15 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results)
             return "GetAdaptersAddresses() failed";
     }
 
+    uint32_t defaultRouteIfIndex = (uint32_t)-1;
+    ffNetifGetDefaultRoute(&defaultRouteIfIndex);
+
     // Iterate through all of the adapters
     for (IP_ADAPTER_ADDRESSES* adapter = adapter_addresses; adapter; adapter = adapter->Next)
     {
+        if (options->defaultRouteOnly && adapter->IfIndex != defaultRouteIfIndex)
+            continue;
+
         bool isLoop = adapter->IfType == IF_TYPE_SOFTWARE_LOOPBACK;
         if (isLoop && !(options->showType & FF_LOCALIP_TYPE_LOOP_BIT))
             continue;
@@ -91,7 +96,7 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results)
             uint8_t* ptr = adapter->PhysicalAddress;
             snprintf(addressBuffer, sizeof(addressBuffer), "%02x:%02x:%02x:%02x:%02x:%02x",
                         ptr[0], ptr[1], ptr[2], ptr[3], ptr[4], ptr[5]);
-            addNewIp(results, name, addressBuffer, -1, newIp, adapter->IfIndex);
+            addNewIp(results, name, addressBuffer, -1, newIp, adapter->IfIndex == defaultRouteIfIndex);
             newIp = false;
         }
 
@@ -102,7 +107,7 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results)
                 SOCKADDR_IN* ipv4 = (SOCKADDR_IN*) ifa->Address.lpSockaddr;
                 char addressBuffer[INET_ADDRSTRLEN];
                 inet_ntop(AF_INET, &ipv4->sin_addr, addressBuffer, INET_ADDRSTRLEN);
-                addNewIp(results, name, addressBuffer, AF_INET, newIp, adapter->IfIndex);
+                addNewIp(results, name, addressBuffer, AF_INET, newIp, adapter->IfIndex == defaultRouteIfIndex);
                 newIp = false;
             }
             else if (ifa->Address.lpSockaddr->sa_family == AF_INET6)
@@ -110,21 +115,11 @@ const char* ffDetectLocalIps(const FFLocalIpOptions* options, FFlist* results)
                 SOCKADDR_IN6* ipv6 = (SOCKADDR_IN6*) ifa->Address.lpSockaddr;
                 char addressBuffer[INET6_ADDRSTRLEN];
                 inet_ntop(AF_INET6, &ipv6->sin6_addr, addressBuffer, INET6_ADDRSTRLEN);
-                addNewIp(results, name, addressBuffer, AF_INET6, newIp, adapter->IfIndex);
+                addNewIp(results, name, addressBuffer, AF_INET6, newIp, adapter->IfIndex == defaultRouteIfIndex);
                 newIp = false;
             }
         }
     }
 
-    uint32_t ifIndex;
-    if (ffNetifGetDefaultRoute(&ifIndex))
-    {
-        FF_LIST_FOR_EACH(FFLocalIpResult, ip, *results)
-        {
-            if (ip->ifIndex != ifIndex) continue;
-            ip->defaultRoute = true;
-        }
-    }
-
     return NULL;
 }
diff --git a/src/modules/localip/localip.c b/src/modules/localip/localip.c
index 705a6c902..c96b09806 100644
--- a/src/modules/localip/localip.c
+++ b/src/modules/localip/localip.c
@@ -86,9 +86,6 @@ void ffPrintLocalIp(FFLocalIpOptions* options)
 
         FF_LIST_FOR_EACH(FFLocalIpResult, ip, results)
         {
-            if (options->defaultRouteOnly && !ip->defaultRoute)
-                continue;
-
             if (flag)
                 fputs(" - ", stdout);
             else
@@ -104,9 +101,6 @@ void ffPrintLocalIp(FFLocalIpOptions* options)
 
         FF_LIST_FOR_EACH(FFLocalIpResult, ip, results)
         {
-            if (options->defaultRouteOnly && !ip->defaultRoute)
-                continue;
-
             formatKey(options, ip, results.length == 1 ? 0 : index + 1, &key);
             if(options->moduleArgs.outputFormat.length == 0)
             {