Networking
Networking is Linux's home ground — the OS runs the internet's routers, servers, and backbones. This chapter covers the practical surface: ip for interfaces and routes, ss for sockets, ssh for remote work, curl/wget for transfers, dig for DNS, tcpdump for the wire, and nftables/iptables for the firewall — enough to configure, diagnose, and defend a networked Linux.
The plumbing — ip
ip addr # interfaces + addresses — replaces ifconfig
ip link # the link layer — up/down, MAC
ip route # the routing table — default via...
ip -s link # per-interface counters
ip addr add 192.168.1.10/24 dev eth0 # add an address
ip link set eth0 up # bring it up
ip route add default via 192.168.1.1 # the gateway
ip neigh # ARP/neighbors — who's on the wireip is the unified interface — addr/link/route/neigh/rule/tunnel cover what ifconfig, route, arp did historically. Learn ip; the rest are legacy.
DNS — name to number
dig example.com # the full answer
dig +short example.com # just the IP
dig MX example.com # mail records
dig -x 8.8.8.8 # reverse lookup
host example.com # the simple version
cat /etc/resolv.conf # which resolvers you ask
cat /etc/hosts # the local overrides — checked BEFORE DNS
getent hosts example.com # the NSS path — hosts+DNS+everything/etc/hosts beats DNS — the local override mechanism (127.0.0.1 myserver — the classic trick for local development). nsswitch.conf decides the order.
Sockets — who's listening
ss -tlnp # TCP listeners — who serves what
ss -tln # without process info
ss -ulnp # UDP listeners
ss -s # summary stats
lsof -i :80 # who owns port 80
nc -zv host 22 # port-probe — "can I reach sshd?"
nc -l 8080 # a listener in one liness -tlnp is the security audit — every open port, every owning process, in one command.
Connectivity diagnosis
ping -c3 1.1.1.1 # reach the world (IP layer)
ping -c3 example.com # + DNS
traceroute example.com # the hops — mtr is the better version
curl -I https://x.com # headers — is the service alive?
curl -v https://x.com # the whole conversation — TLS, headers, all
wget -c url # resumable download
curl -o file url # downloadThe diagnostic sequence — ping gateway → ping 1.1.1.1 → ping name — localizes every network failure in three steps: link, route, DNS.
ssh — the remote door
ssh user@host # remote shell
ssh -p 2222 user@host # nonstandard port
ssh -i ~/.ssh/key user@host # key auth
scp file user@host:/path/ # copy over ssh
rsync -avz dir/ user@host:/path/ # the better copy — incremental, resumable
ssh -L 8080:remote:80 user@host # port forward — the tunnel
ssh -D 1080 user@host # SOCKS proxy through ssh
ssh-keygen -t ed25519 # generate a keypair
ssh-copy-id user@host # install your pubkey
cat ~/.ssh/known_hosts # the trust storeKey auth beats passwords — ~/.ssh/id_ed25519 private (mode 600, never leaves), .pub public (installed in ~/.ssh/authorized_keys on the far side). ~/.ssh/config names hosts: Host myvps\n HostName 1.2.3.4\n User admin\n Port 2222 → ssh myvps.
The wire — tcpdump
tcpdump -i eth0 # everything on the interface
tcpdump -i eth0 port 80 # HTTP only
tcpdump -i eth0 host 1.2.3.4 # to one peer
tcpdump -i eth0 -n icmp # no DNS lookups, ICMP only
tcpdump -w capture.pcap # to file — read with wiresharkThe wire is honest — when the application lies, tcpdump shows what actually moved.
The firewall — nftables
nft list ruleset # the current policy
nft add table inet filter # modern firewall setup
iptables -L # the legacy listing — still everywhere
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -j DROP # the default-deny tailnftables is the modern engine (nft); iptables is the legacy syntax — both write the same kernel netfilter rules. The pattern: default-deny incoming, allow what's needed (22, your services), log drops.
The interfaces — bridges, bonds, tunnels
ip link add name br0 type bridge # a software switch
ip link add name wg0 type wireguard # a VPN interface
ip tunnel add tun0 mode gre remote x local y # a tunnel
ip link add veth0 type veth peer name veth1 # a cable between namespacesInterfaces aren't just hardware — the kernel manufactures virtual ones. WireGuard's wg0, Docker's veth, a bridge between a VM and the world — all ip link citizens.
The hostname + interface files
/etc/hostname, /etc/hosts, /etc/resolv.conf, /etc/sysconfig/ifconfig.eth0 (Slackware/LFS), netplan YAML (Ubuntu), NetworkManager (desktop distros), systemd-networkd (systemd) — each distro's answer to "how does interface config persist" — the files chapter 6 of LFS writes by hand.
Where networking goes wrong
| Symptom | Cause |
|---|---|
| Ping IP works, ping name doesn't | DNS — resolv.conf/nsswitch |
| Ping name works, IP doesn't | Routing — ip route, the gateway |
| ssh "connection refused" | sshd not listening — ss -tlnp | grep 22 |
| ssh "permission denied" | Key/auth — -v shows the dance |
| Port open but unreachable | Firewall — iptables -L/nft list ruleset |
| Interface exists, no address | ip link set X up + ip addr add |
| Everything works but one host | /etc/hosts stale entry |
Exercises
ss -tlnp— inventory every listener on your box; identify each.ip route,ip neigh— read your real routing table.ssh -L 8080:localhost:80 user@host— build a tunnel; browse through it.tcpdump -i any icmpwhile pinging — see the wire.dig +shortthengetent hosts— the two DNS paths.curl -va site — read the TLS + headers.