,NETWORKING IS ,LINUX'S HOME GROUND THE ,,OS RUNS THE INTERNET'S ROUTERS1 SERVERS1 AND BACKBONES4 ,THIS CHAPTER COVERS THE PRACTICAL SURFACE3 IP FOR INTERFACES AND ROUTES1 SS FOR SOCKETS1 SSH FOR REMOTE WORK1 CURL_/WGET FOR TRANSFERS1 DIG FOR ,,DNS1 TCPDUMP FOR THE WIRE1 AND NFTABLES_/IPTABLES FOR THE FIREWALL ENOUGH TO CONFIGURE1 DIAGNOSE1 AND DEFEND A NETWORKED ,LINUX4 ,THE PLUMBING IP IP ADDR _? INTERFACES "6 ADDRESSES REPLACES IFCONFIG IP LINK _? THE LINK LAYER UP_/DOWN1 ,,MAC IP ROUTE _? THE ROUTING TABLE DEFAULT VIA444 IP -;S LINK _? PER-INTERFACE COUNTERS IP ADDR ADD #AIB4AFH4A4AJ_/#BD DEV ETH#J _? ADD AN ADDRESS IP LINK SET ETH#J UP _? BRING IT UP IP ROUTE ADD DEFAULT VIA #AIB4AFH4A4A _? THE GATEWAY IP NEIGH _? ,,ARP_/NEIGHBORS WHO'S ON THE WIRE IP IS THE UNIFIED INTERFACE ADDR_/LINK_/ROUTE_/NEIGH_/RULE_/TUNNEL COVER WHAT IFCONFIG1 ROUTE1 ARP DID HISTORICALLY4 ,LEARN IP2 THE REST ARE LEGACY4 ,,DNS NAME TO NUMBER DIG EXAMPLE4COM _? THE FULL ANSWER DIG "6SHORT EXAMPLE4COM _? JUST THE ,,IP DIG ,,MX EXAMPLE4COM _? MAIL RECORDS DIG -;X #H4H4H4H _? REVERSE LOOKUP HOST EXAMPLE4COM _? THE SIMPLE VERSION CAT _/ETC_/RESOLV4CONF _? WHICH RESOLVERS YOU ASK CAT _/ETC_/HOSTS _? THE LOCAL OVERRIDES CHECKED ,,BEFORE ,,DNS GETENT HOSTS EXAMPLE4COM _? THE ,,NSS PATH HOSTS"6,,DNS"6EVERYTHING _/ETC_/HOSTS BEATS ,,DNS THE LOCAL OVERRIDE MECHANISM "<#ABG4J4J4A MYSERVER THE CLASSIC TRICK FOR LOCAL DEVELOPMENT">4 NSSWITCH4CONF DECIDES THE ORDER4 ,SOCKETS WHO'S LISTENING SS -TLNP _? ,,TCP LISTENERS WHO SERVES WHAT SS -TLN _? WITHOUT PROCESS INFO SS -ULNP _? ,,UDP LISTENERS SS -;S _? SUMMARY STATS LSOF -I 3#HJ _? WHO OWNS PORT #HJ NC -ZV HOST #BB _? PORT-PROBE 8CAN ,I REACH SSHD80 NC -;L #HJHJ _? A LISTENER IN ONE LINE SS -TLNP IS THE SECURITY AUDIT EVERY OPEN PORT1 EVERY OWNING PROCESS1 IN ONE COMMAND4 ,CONNECTIVITY DIAGNOSIS PING -C#C"A4A4A4A _? REACH THE WORLD "<,,IP LAYER"> PING -C#C EXAMPLE4COM _? "6 ,,DNS TRACEROUTE EXAMPLE4COM _? THE HOPS MTR IS THE BETTER VERSION CURL -,I HTTPS3_/_/X4COM _? HEADERS IS THE SERVICE ALIVE8 CURL -;V HTTPS3_/_/X4COM _? THE WHOLE CONVERSATION ,,TLS1 HEADERS1 ALL WGET -;C URL _? RESUMABLE DOWNLOAD CURL -O FILE URL _? DOWNLOAD ,THE DIAGNOSTIC SEQUENCE PING GATEWAY PING #A4A4A4A PING NAME LOCALIZES EVERY NETWORK FAILURE IN THREE STEPS3 LINK1 ROUTE1 ,,DNS4 SSH THE REMOTE DOOR1 THE WHOLE TOOLKIT SSH USER@AHOST _? REMOTE SHELL SSH -;P #BBBB -I @9_/4SSH_/KEY USER@AHOST _? PORT "6 KEY SSH -;V _/ -VVV USER@AHOST _? THE AUTH-DANCE VERBOSITY LADDER SSH -;,L #HJHJ3REMOTE3#HJ USER@AHOST _? PORT FORWARD THE TUNNEL SSH -;,N -;,L #HJHJ3TARGET3#HJ USER@AHOST _? FORWARD-ONLY1 NO SHELL SSH -F,N -;,L 444 USER@AHOST _? BACKGROUND THE TUNNEL SSH -;,D #AJHJ USER@AHOST _? ,,SOCKS#E PROXY THROUGH SSH SSH -;,R #IJIJ3LOCALHOST3#CJJJ USER@AHOST _? REVERSE FORWARD EXPOSE YOURS SSH -;,J BASTION USER@AINTERNAL _? JUMP HOST ,PROXY,JUMP SSH -O ,STRICT,HOST,KEY,CHECKING"7NO 444 _? SKIP THE VERIFY PROMPT SCP FILE USER@AHOST3_/PATH_/ _? COPY OVER SSH SCP -;R DIR_/ USER@AHOST3_/PATH_/ _? RECURSIVE SFTP USER@AHOST _? THE INTERACTIVE TRANSFER RSYNC -AVZ --PROGRESS DIR_/ USER@AHOST3_/PATH_/ _? THE BEST COPY INCREMENTAL1 RESUMABLE SSH-KEYGEN -;T ED#BEEAI _? GENERATE A KEYPAIR SSH-COPY-ID USER@AHOST _? INSTALL YOUR PUBKEY SSH-ADD2 SSH-AGENT _? THE AGENT KEYS CACHED ONCE SSH-KEYGEN -;,R HOST _? FORGET A CHANGED HOSTKEY CAT @9_/4SSH_/KNOWN.-HOSTS _? THE TRUST STORE CAT @9_/4SSH_/CONFIG3 _? ,HOST MYVPS _? ,HOST,NAME #A4B4C4D _? ,USER ADMIN _? ,PORT #BBBB _? ,IDENTITY,FILE @9_/4SSH_/VPS.-KEY ,KEY AUTH BEATS PASSWORDS @9_/4SSH_/ID.-ED#BEEAI PRIVATE "1 4PUB PUBLIC "4 @9_/4SSH_/CONFIG NAMES HOSTS SSH MYVPS EXPANDS ALL OF IT4 -;,J JUMPS THROUGH A BASTION2 -;,N FORWARDS WITHOUT A SHELL2 -;F BACKGROUNDS2 -;,R IS THE REVERSE-TUNNEL4 ,THE WIRE TCPDUMP TCPDUMP -I ETH#J _? EVERYTHING ON THE INTERFACE TCPDUMP -I ETH#J PORT #HJ _? ,,HTTP ONLY TCPDUMP -I ETH#J HOST #A4B4C4D _? TO ONE PEER TCPDUMP -I ETH#J -;N ICMP _? NO ,,DNS LOOKUPS1 ,,ICMP ONLY TCPDUMP -;W CAPTURE4PCAP _? TO FILE READ WITH WIRESHARK ,THE WIRE IS HONEST WHEN THE APPLICATION LIES1 TCPDUMP SHOWS WHAT ACTUALLY MOVED4 ,THE FIREWALL NFTABLES NFT LIST RULESET _? THE CURRENT POLICY PRINTS IT AS A SCRIPT NFT ADD TABLE INET FILTER _? MODERN FIREWALL SETUP NFT ADD CHAIN INET FILTER INPUT '_< TYPE FILTER HOOK INPUT PRIORITY #J2 POLICY DROP2 _>' NFT ADD RULE INET FILTER INPUT IIF LO ACCEPT NFT ADD RULE INET FILTER INPUT CT STATE ESTABLISHED1RELATED ACCEPT NFT ADD RULE INET FILTER INPUT TCP DPORT '_<#BB1 #HJ1 #DDC_>' ACCEPT NFT ADD RULE INET FILTER INPUT ICMP TYPE ECHO-REQUEST ACCEPT NFT -A LIST RULESET _? HANDLES FOR DELETING RULES NFT FLUSH RULESET _? CLEAR IT ALL IPTABLES -;,L _? THE LEGACY LISTING STILL EVERYWHERE IPTABLES -,A ,,INPUT -;P TCP --DPORT #BB -;J ,,ACCEPT IPTABLES-TRANSLATE -,A ,,INPUT -;P TCP --DPORT #BB -;J ,,ACCEPT _? LEGACYNFT NFTABLES IS THE MODERN ENGINE "2 IPTABLES IS THE LEGACY SYNTAX BOTH WRITE THE SAME KERNEL NETFILTER RULES4 ,THE POLICY GRAMMAR3 TABLES " CHAINS " RULES "4 POLICY DROP IS THE DEFAULT-DENY POSTURE3 ALLOW WHAT'S NEEDED "<#BB1 YOUR SERVICES">1 LOG DROPS4 ,THE PROTOCOLS THE LAYERED MAP _? THE STACK3 ,L#A PHYSICAL ,L#B ETHERNET ,L#C ,,IP ,L#D ,,TCP_/,,UDP ,L#G ,,HTTP_/,,SSH_/,,DNS PING USES ,,ICMP "<,L#C"> _? REACHABILITY ARP _/ IP NEIGH _? ,L#B,L#C MAPPING WHO HAS THIS ,,IP ON THE WIRE ,,TCP "7 ORDERED STREAMS _? SSH1 HTTP1 EVERYTHING RELIABLE ,,UDP "7 DATAGRAMS _? ,,DNS1 ,WIRE,GUARD1 ,VO,I,P FAST1 UNORDERED ICMP "7 DIAGNOSTICS _? PING1 TRACEROUTE1 ,,PMTUD TRACEROUTE EXPLOITS ,,TTL ,,UDP_/,,ICMP PROBES WITH INCREASING ,T,T,LS DIE AT EACH HOP AND REPORT BACK THE PATH ITSELF REVEALED4 MTR IS THE CONTINUOUS VERSION4 ,THE SOCKET TAXONOMY SS -;X _? UNIX SOCKETS LOCAL ,,IPC SS -;T _? ,,TCP SS -;U _? ,,UDP SS -;L _? LISTENERS SS -;P _? PROCESSES SS -O STATE ESTABLISHED _? FILTER BY STATE SS -TN DST #A4B4C4D _? BY PEER NC -;L -;P #HJHJ _? A RAW LISTENER " NC HOST #HJHJ @< FILE _? SEND A FILE NC -ZV HOST #A-#AJJJ _? PORT RANGE SCAN SOCAT ,,TCP-;,L3#HJHJ1FORK ,,TCP3TARGET3#HJ _? THE SWISS-ARMY SOCKET TOOL ,ADVANCED IP THE GROWN-UP COMMANDS IP ROUTE SHOW TABLE ALL _? ALL ROUTING TABLES IP RULE ADD FROM #AJ4J4J4J_/#H TABLE #AJJ _? POLICY ROUTING IP ROUTE ADD #AJ4J4J4J_/#H VIA #AIB4AFH4A4A TABLE #AJJ IP ADDR ADD #AJ4J4J4E_/#BD DEV ETH#J LABEL ETH#J3VIP _? SECONDARY ,,IP A ,,VIP IP LINK SET ETH#J MTU #ADJJ _? ,,MTU SURGERY THE TUNNEL FIX IP LINK SET ETH#J PROMISC ON _? SNIFFING MODE IP -;S -;H LINK _? HUMAN-READABLE COUNTERS IP -;J ADDR SHOW _? ,,JSON OUTPUT SCRIPTABLE ,INTERFACES BRIDGES1 BONDS1 TUNNELS IP LINK ADD NAME BR#J TYPE BRIDGE _? A SOFTWARE SWITCH IP LINK ADD NAME WG#J TYPE WIREGUARD _? A ,,VPN INTERFACE IP TUNNEL ADD TUN#J MODE GRE REMOTE ;X LOCAL ;Y _? A TUNNEL IP LINK ADD VETH#J TYPE VETH PEER NAME VETH#A _? A CABLE BETWEEN NAMESPACES ,INTERFACES AREN'T JUST HARDWARE THE KERNEL MANUFACTURES VIRTUAL ONES4 ,WIRE,GUARD'S WG#J1 ,DOCKER'S VETH1 A BRIDGE BETWEEN A ,,VM AND THE WORLD ALL IP LINK CITIZENS4 CURL THE ,,HTTP INSTRUMENT CURL -,I URL _? HEADERS ONLY CURL -;V URL _? THE WHOLE CONVERSATION ,,TLS1 REDIRECTS CURL -O FILE URL _? DOWNLOAD CURL -,O URL _? KEEP FILENAME CURL -;,L URL _? FOLLOW REDIRECTS CURL -;K URL _? SKIP ,,TLS VERIFY THE 8IS IT THE CERT80 TEST CURL -;S URL _\ JQ 4 _? ,,API PIPING CURL -;,X ,,POST -;D 'A"7B' URL _? ,,POST CURL -;,H ',AUTH3 TOKEN' URL _? HEADERS CURL -;U USER3PASS URL _? BASIC AUTH CURL --CONNECT-TIMEOUT #E URL _? TIMEOUTS CURL -;W '.0_ .0__*N' -O _/DEV_/NULL URL _? THE TIMING PROBE -;W TURNS CURL INTO A LATENCY INSTRUMENT TIME.-TOTAL1 TIME.-NAMELOOKUP1 TIME.-CONNECT1 TIME.-APPCONNECT THE ,,DNS_/,,TCP_/,,TLS BREAKDOWN4 ,THE HOSTNAME "6 INTERFACE FILES _/ETC_/HOSTNAME1 _/ETC_/HOSTS1 _/ETC_/RESOLV4CONF1 _/ETC_/SYSCONFIG_/IFCONFIG4ETH#J "<,SLACKWARE_/,,LFS">1 NETPLAN ,,YAML "<,UBUNTU">1 ,NETWORK,MANAGER "1 SYSTEMD-NETWORKD " EACH DISTRO'S ANSWER TO 8HOW DOES INTERFACE CONFIG PERSIST0 THE FILES CHAPTER #F OF ,,LFS WRITES BY HAND4 ,WHERE NETWORKING GOES WRONG ,SYMPTOM ,CAUSE ,PING ,,IP WORKS1 PING NAME DOESN'T ,,DNS RESOLV4CONF_/NSSWITCH ,PING NAME WORKS1 ,,IP DOESN'T ,ROUTING IP ROUTE1 THE GATEWAY SSH 8CONNECTION REFUSED0 SSHD NOT LISTENING SS -TLNP GREP #BB SSH 8PERMISSION DENIED0 ,KEY_/AUTH -;V SHOWS THE DANCE ,PORT OPEN BUT UNREACHABLE ,FIREWALL IPTABLES -,L_/NFT LIST RULESET ,INTERFACE EXISTS1 NO ADDRESS IP LINK SET ;,X UP "6 IP ADDR ADD ,EVERYTHING WORKS BUT ONE HOST _/ETC_/HOSTS STALE ENTRY ,EXERCISES #A4 SS -TLNP INVENTORY EVERY LISTENER ON YOUR BOX2 IDENTIFY EACH4 #B4 IP ROUTE1 IP NEIGH READ YOUR REAL ROUTING TABLE4 #C4 SSH -;,L #HJHJ3LOCALHOST3#HJ USER@AHOST BUILD A TUNNEL2 BROWSE THROUGH IT4 #D4 TCPDUMP -I ANY ICMP WHILE PINGING SEE THE WIRE4 #E4 DIG "6SHORT THEN GETENT HOSTS THE TWO ,,DNS PATHS4 #F4 CURL -;V A SITE READ THE ,,TLS "6 HEADERS4 ,SEE ALSO - ,LINUX ,WIRE,GUARD ,TUNNELING ,INSIDE A ,LINUX ,SYSTEM