Day 4 - Network Configuration and Commands

📌 Key Takeaways

• Network device names are lo (loopback), eth0/ens33 (wired), and wlan0 (wireless).
• ifconfig is the old tool; ip is the current standard. Memorize them as pairs.
• DNS server addresses go in /etc/resolv.conf, and manual name-to-IP mappings go in /etc/hosts.
• Use netstat (old) and ss (current) to see open ports and connections.
• ping tells you whether you can reach a host, and traceroute tells you where it gets blocked.

Network Device Names

• In the past, cards were named eth0, eth1 in the order they were detected, which caused the problem of names changing on every reboot. That is why names like enp0s3, which reflect the slot location, were introduced.
• lo is always present, even without a physical network card.

ifconfig and ip

ip addr                    # addresses of all interfaces
ifconfig eth0              # a specific interface only
ip route                   # routing table (check the default gateway)
route -n                   # numeric output, no name resolution
arp -a                     # list of MAC addresses on the same network

ifconfig, route, netstat, and arp belong to the net-tools package, while ip and ss belong to the iproute2 package. Some modern distributions do not install net-tools by default. The exam asks about both.

Reading the Output

Viewing the same interface with the two commands looks like this.

$ ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.10  netmask 255.255.255.0  broadcast 192.168.0.255
        ether 00:1a:2b:3c:4d:5e  txqueuelen 1000  (Ethernet)
 
$ ip addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:1a:2b:3c:4d:5e brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.10/24 brd 192.168.0.255 scope global eth0
       valid_lft forever preferred_lft forever

• The mask notation differs. ifconfig shows 255.255.255.0, while ip shows /24. As we learned yesterday, they are the same value. The broadcast address 192.168.0.255 also matches the /24 network with all host bits set to 1.
• Running ifconfig with no arguments shows only interfaces that are up. To see interfaces that are down as well, use ifconfig -a. ip addr shows everything by default.
• ip takes the form ip OBJECT ACTION. The object is addr (addresses), link (the device itself), route (routes), or neigh (neighbors, i.e. the ARP table). Questions like to mix these up: addr for addresses, link for turning a device on and off.

ifconfig eth0 192.168.0.10 netmask 255.255.255.0 up   # set address and mask, and bring it up
ifconfig eth0 down                                    # bring it down
ip link set eth0 down                                 # same thing
route add default gw 192.168.0.1                      # register the default gateway
ip route add default via 192.168.0.1                  # same thing
route del default                                     # delete it

⚠️ Addresses and routes set with commands disappear after a reboot. They only take effect in memory. To make them permanent, you must write them in the configuration files below. If a question adds the condition "so that it persists after reboot", the answer is a file, not a command.

• The old and new commands use different keywords. For the default gateway, route uses gw and ip route uses via.

Default Gateway

ip route
# default via 192.168.0.1 dev eth0     ← default gateway
route -n
# 0.0.0.0    192.168.0.1   0.0.0.0   UG   ...

• The line starting with default (or 0.0.0.0) is the default gateway. All traffic leaving the internal network goes through it.

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.0.1     0.0.0.0         UG    100    0        0 eth0
192.168.0.0     0.0.0.0         255.255.255.0   U     100    0        0 eth0

• The second line means traffic for the same network (192.168.0.0/24) is sent directly, without a gateway. The first line means everything else is handed to 192.168.0.1.
• A computer uses the subnet mask to decide whether the destination is inside or outside its own network. If inside, it sends directly; if outside, it sends to the default gateway. This is why a wrong mask can break communication even on the same network.
• route and netstat -r show the same table. -n in both means "show numbers, don't convert to names".

ARP Table

$ arp -n
Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.0.1              ether   00:11:22:33:44:55   C                     eth0

• Actual delivery inside the same network is done by MAC address. So to send to a peer whose IP you know, you first have to find that IP's MAC, and the ARP table is where the result is kept for a while.
• arp -a shows everything, arp -d ADDRESS deletes an entry, and arp -s ADDRESS MAC adds one manually.
• Only devices on the same network appear in the table. Peers outside the network are reached through the default gateway's MAC, so only the gateway shows up.

Viewing Connections and Ports

netstat -tulpn        # open ports (traditional)
ss -tulpn             # same thing (current standard, faster)
netstat -an | grep 80

• It helps to memorize the -tulpn combination as a whole. It is the standard command for seeing "which service is opening which port".

# netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1023/sshd
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1187/master

• Local Address has the form ADDRESS:PORT. 0.0.0.0:22 means it accepts connections on port 22 no matter which address they arrive at, while 127.0.0.1:25 means it only accepts connections coming from this computer. The service on the second line cannot be reached from outside even though the port is open.
• LISTEN in State means waiting for connections. If you drop -l and use -a, already connected sockets (ESTABLISHED) appear as well.
• Seeing other users' process names with -p requires root privileges. Run as a regular user, that column shows an empty -.

• netstat alone shows ports, connections, routing, and interface statistics. When asked to pick "a command that cannot show the routing table", don't forget netstat -r.

Diagnostic Commands

ping -c 4 8.8.8.8         # send only 4 packets
traceroute www.google.com # trace the route
nslookup naver.com        # name → IP
dig naver.com             # more detailed DNS lookup

• If ping works but the web does not, suspect DNS. The IP is reachable but the name cannot be resolved.
• ping uses ICMP. A server that blocks ICMP by security policy will not respond even though it is alive.

$ ping -c 4 192.168.0.1
PING 192.168.0.1 (192.168.0.1) 56(84) bytes of data.
64 bytes from 192.168.0.1: icmp_seq=1 ttl=64 time=0.412 ms
64 bytes from 192.168.0.1: icmp_seq=2 ttl=64 time=0.398 ms
64 bytes from 192.168.0.1: icmp_seq=3 ttl=64 time=0.455 ms
64 bytes from 192.168.0.1: icmp_seq=4 ttl=64 time=0.419 ms
 
--- 192.168.0.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 0.398/0.421/0.455/0.021 ms

• Linux ping keeps sending until told to stop. End it with Ctrl+C, or set a count in advance with -c COUNT. Besides that, -i is the interval between packets (seconds) and -s is the packet size.
• traceroute uses this TTL. When it sends packets with TTL increased as 1, 2, 3 …, the router at the point where the value reaches 0 responds in turn, revealing the route. A line showing only * * * in the middle means that router did not respond.

Where Did It Break — Start from the Nearest

• Work from the inside out; the first step that fails is where the fault is.
• If steps up to 4 work and only step 5 fails, it means you can reach addresses but cannot resolve names. Look at the DNS settings, not the LAN cable or the gateway.
• Also, ethtool eth0 shows the network card's speed and link status. The old tool that did the same job is mii-tool. Use it to check first whether the cable is physically connected.

Configuration Files

/etc/resolv.conf

   nameserver 8.8.8.8
   nameserver 168.126.63.1
   search example.com

• This is the file where DNS servers are registered. If this file is empty, domain names cannot be converted to IPs.
• This is the answer to the question "Which file registers the DNS server address?"

/etc/hosts

   127.0.0.1     localhost
   192.168.0.50  myserver

• It is checked before DNS. If you write an entry here, you can connect by name without DNS.
• The order is decided by the hosts: line in /etc/nsswitch.conf, usually files dns — that is, /etc/hosts first, then DNS.

Answer choices that swap the two files are easy to use as wrong answers. hosts is where you write the answers down, and resolv.conf is where you write whom to ask.

• A line in /etc/hosts has the order IP_ADDRESS NAME [ALIAS …]. The IP comes first.
• nameserver entries in /etc/resolv.conf are asked starting from the top, and moving on to the next line happens when there is no response. search example.com is the domain appended when you type just a short name like www.

Interface Configuration File (Red Hat Family)

   # /etc/sysconfig/network-scripts/ifcfg-eth0
   DEVICE=eth0
   BOOTPROTO=static
   ONBOOT=yes
   IPADDR=192.168.0.10
   NETMASK=255.255.255.0
   GATEWAY=192.168.0.1
   DNS1=8.8.8.8

• With BOOTPROTO=dhcp, you do not write IPADDR and the lines after it, because the server hands out the address.
• The location and format of this file vary by distribution and version. Debian-family systems have used /etc/network/interfaces, and recent distributions manage the configuration with separate tools such as NetworkManager, so this file may not exist. The exam asks for "the interface configuration file of the Red Hat family" as ifcfg-DEVICE_NAME.

Tomorrow we will tie this week's networking concepts together on a single page.

📖 Glossary

• lo : The loopback interface. Used to communicate with the machine itself.
• ifconfig / ip : The old / current standard commands for viewing and configuring network interfaces.
• Default gateway : The address of the router that traffic leaving the internal network passes through.
• netstat / ss : The old / current commands for viewing open ports and connection states.
• ping : A command that checks with ICMP whether the peer is reachable.
• traceroute : A command that shows, step by step, the route taken to the destination.
• /etc/resolv.conf : The file that registers the DNS server addresses used for lookups.
• /etc/hosts : The file that maps host names directly to IP addresses.