Northeast Mississippi Community CollegeCourse Notes

Linux Operating Systems Fundamentals · Lesson 8

Configuring Basic Networking

IPv4 and IPv6 addressing, ports, DNS and DHCP, persistent network configuration with NetworkManager, Netplan, and ip, and layered network troubleshooting.

  • linux
  • networking
  • ipv4
  • ipv6
  • dns
  • dhcp
  • nmcli
  • troubleshooting
  • lpic-1

Lesson purpose

Almost every Linux system needs a network connection to share files, reach services, and get security updates. This lesson builds a working model of IP networking (addresses, netmasks, routers, ports, and DNS), shows the several ways Linux stores and applies network settings, and gives students a step-by-step troubleshooting toolkit from ping to ss and nc.

Learning objectives

  • Describe the physical, network, transport, and application layers and what each contributes.
  • Explain IPv4 and IPv6 addresses, netmasks and CIDR notation, private ranges and NAT, default routers, DNS, and DHCP.
  • Identify common TCP and UDP well-known ports and the /etc/services file.
  • Configure persistent network settings using distribution files, NetworkManager (nmcli, nmtui), and the ip command, and recognize the legacy net-tools commands.
  • Configure host names and client-side DNS with hostnamectl, /etc/hosts, /etc/resolv.conf, and /etc/nsswitch.conf.
  • Describe DHCP clients, interface bonding, and bridging.
  • Troubleshoot connectivity, routing, name resolution, and listening services with ping, traceroute/tracepath, host, dig, nslookup, getent, netstat, ss, and nc.

LPIC-1 exam focus

  • 109.1 Fundamentals of internet protocols
  • 109.2 Persistent network configuration
  • 109.3 Basic network troubleshooting
  • 109.4 Configure client-side DNS

1. A four-layer model

The OSI model has seven layers. This lesson uses a simpler four-layer view that matches how you troubleshoot: check each layer from the bottom up.

Layer Job Examples
Physical Move bits between devices Ethernet cable, fiber, Wi-Fi, switches, access points
Network Address hosts and route packets between networks IPv4, IPv6, ICMP, routers
Transport Deliver data to the right application on the host TCP, UDP, ports
Application Do the actual work SSH, HTTP, DNS, SMTP

Troubleshooting order: Is the link up? Do I have an address? Can I reach the gateway? Can I resolve names? Is the service listening?

2. The physical layer

  • Wired networks connect devices with Ethernet (copper) or fiber-optic cables through switches, which forward each frame only to the port where its destination is. Large networks cascade switches to divide traffic into segments. Wired links give the highest speeds (100 Gbps and more), which is why servers use them.
  • Wireless networks use radio signals between devices and an access point. Each access point advertises a service set identifier (SSID), its network name.
  • Wireless security: radio signals leave the building, so always use encryption. WEP is broken and must never be used. Use WPA2, or WPA3 where available. The book lists WEP, WPA, and WPA2; only WPA2 and WPA3 are acceptable today.
  • MAC address: every network interface has a 48-bit hardware address, such as 08:00:27:2c:35:d2, which switches use to deliver frames on the local network.

3. IPv4 addressing

  • Address: 32 bits written in dotted-decimal notation as four 8-bit octets, for example 192.168.1.10.
  • Network part and host part. All devices on the same local network share the network part, and each device has a unique host part.
  • Netmask: 1 bits mark the network part and 0 bits mark the host part. 255.255.255.0 means the first three octets are the network.
  • CIDR notation gives the number of network bits after a slash: 192.168.1.0/24 is the same as network 192.168.1.0 with netmask 255.255.255.0. Newer tools such as ip and nmcli use CIDR, while older configuration files often use the netmask.
CIDR Netmask Usable hosts
/8 255.0.0.0 16,777,214
/16 255.255.0.0 65,534
/24 255.255.255.0 254
/30 255.255.255.252 2

In a /24 such as 192.168.1.0/24, the first address (.0) identifies the network, the last address (.255) is the broadcast address, and .1–.254 are available for hosts.

Historical classes: Before CIDR, the first octet set the default mask: Class A (1–126, /8), Class B (128–191, /16), and Class C (192–223, /24). You’ll still hear these names.

Private addresses and NAT

The Internet Assigned Numbers Authority (IANA) manages public address assignments. Three ranges are reserved for private networks (RFC 1918). They aren’t routed on the internet:

  • 10.0.0.0/8 (10.0.0.0–10.255.255.255)
  • 172.16.0.0/12 (172.16.0.0–172.31.255.255)
  • 192.168.0.0/16 (192.168.0.0–192.168.255.255)

Other special addresses:

  • 127.0.0.0/8, the loopback network. 127.0.0.1 is “this host.”
  • 169.254.0.0/16, link-local. A host assigns itself one of these when DHCP fails, which is a useful clue when troubleshooting.

Network address translation (NAT) lets a router share one public address with a whole private network. This is how a home or campus network reaches the internet, and it greatly slowed the exhaustion of IPv4 addresses.

4. IPv6 addressing

  • 128-bit addresses written as eight groups of four hexadecimal digits separated by colons: fed1:0000:0000:08d3:1319:8a2e:0370:7334.
  • Shortening rules:
    • Drop leading zeros in any group: 08d3 becomes 8d3.
    • Replace one run of consecutive all-zero groups with ::: fed1::8d3:1319:8a2e:370:7334.
    • :: may appear only once in an address; otherwise the length would be ambiguous.
  • Prefix length works like CIDR. A LAN is almost always /64: the first 64 bits identify the network, and the last 64 bits identify the interface.
  • Link-local addresses (fe80::/10) are assigned automatically on every IPv6 interface and are used only on the local link. The host part used to be derived from the MAC address. Modern systems often use stable private or random identifiers instead, for privacy.
  • Global addresses are routable on the internet. They’re assigned by stateless autoconfiguration (SLAAC), DHCPv6, or manual configuration.
  • Loopback is ::1.

Check for understanding: Why is 2003:aef0::23d1::a10:a1 invalid? (It uses :: twice.) One of the book’s configuration examples contains this mistake, so the examples below are corrected.

5. Routers, DNS, and DHCP

Default router (gateway)

Hosts can send packets directly only to hosts on the same local network. Everything else goes to a router. The default router (default gateway) is where a host sends any packet it has no more specific route for, and it must be on the host’s own subnet.

A host needs three values to communicate with IP:

Host address:     192.168.20.5
Netmask:          255.255.255.0      (/24)
Default gateway:  192.168.20.1

Host names and DNS

  • The Domain Name System (DNS) maps names to addresses. A fully qualified domain name (FQDN) combines a host name and a domain name, for example shadrach.example.org.
  • Clients need only the address of a DNS server. That server queries others on the client’s behalf.
  • DNS is also a source of outages. If a numeric address works but a name doesn’t, the problem is DNS.

DHCP

  • The Dynamic Host Configuration Protocol (DHCP) hands out an address, netmask, gateway, and DNS servers automatically. The assignment is a lease and can change.
  • Most home and office routers include a DHCP server.
  • Servers should use static addresses (or DHCP reservations) so clients can always find them.

6. The transport and application layers

  • Ports identify the application on a host. The IP address is like the street address of an apartment building, and the port is like the apartment number. The pair of address and port is a socket.
  • TCP (Transmission Control Protocol) is connection-oriented and reliable: it acknowledges data, retransmits lost segments, and delivers in order. The price is overhead. It’s used by SSH, HTTP/HTTPS, SMTP, and IMAP.
  • UDP (User Datagram Protocol) is connectionless: fast and lightweight, with no delivery guarantee. It’s used by DNS queries, NTP, DHCP, syslog, and live voice and video, where a lost packet is only a brief glitch.
  • ICMP (Internet Control Message Protocol) carries error and control messages, such as “destination unreachable” and “time exceeded.” ping and traceroute depend on it. The book groups ICMP with the transport layer; strictly speaking, it’s a network-layer protocol that works alongside IP.

Well-known ports

Servers listen on well-known ports (0–1023) so that clients know where to connect. /etc/services maps port numbers to names, which is why tools may show ssh instead of 22.

Port Protocol Service
20, 21 TCP FTP data, FTP control
22 TCP SSH
23 TCP Telnet (unencrypted; avoid)
25 TCP SMTP
53 TCP & UDP DNS
67, 68 UDP DHCP server, client
80 TCP HTTP
110 TCP POP3
123 UDP NTP
139 TCP NetBIOS session (SMB)
143 TCP IMAP
161, 162 UDP SNMP, SNMP trap
389 TCP LDAP
443 TCP HTTPS
465 TCP SMTPS (SMTP over TLS)
514 TCP / UDP rsh (TCP), syslog (UDP)
587 TCP Mail submission
636 TCP LDAPS
993 TCP IMAPS (IMAP over TLS)
995 TCP POP3S

The book labels port 993 as LDAPS. It’s IMAPS; LDAPS is 636.

$ grep -w 22 /etc/services
ssh             22/tcp

7. What a Linux host needs, and where it’s stored

Five settings:

  1. Host address
  2. Netmask (subnet)
  3. Default router
  4. Host name
  5. DNS server

There are three ways to set them: edit configuration files, use a graphical tool, or use command-line tools. No single configuration file is used by every distribution.

Family Traditional location Current practice
Debian /etc/network/interfaces (ifupdown) NetworkManager on desktops
Ubuntu (17.10 and later) — Netplan YAML in /etc/netplan/, rendered for NetworkManager or systemd-networkd
Red Hat / Fedora /etc/sysconfig/network-scripts/ifcfg-* and /etc/sysconfig/network NetworkManager keyfiles in /etc/NetworkManager/system-connections/ (RHEL 9 and later)
openSUSE /etc/sysconfig/network/ wicked or NetworkManager
systemd-networkd — /etc/systemd/network/*.network

Classroom convention: Configure lab systems with nmcli (or Netplan on Ubuntu Server) and inspect them with ip. Learn to read the legacy files for the exam.

Debian /etc/network/interfaces

auto eth0
iface eth0 inet static
    address 192.168.1.77
    netmask 255.255.255.0
    gateway 192.168.1.254

iface eth0 inet6 static
    address 2003:aef0:23d1::a10:a1
    netmask 64
    gateway 2003:aef0:23d1::1
  • auto eth0 brings the interface up at boot.
  • inet is IPv4 and inet6 is IPv6. The method can be static, dhcp, or (for IPv6) auto, which means SLAAC.
auto eth0
iface eth0 inet dhcp
iface eth0 inet6 auto

Ubuntu Netplan

# /etc/netplan/01-lab.yaml
network:
  version: 2
  ethernets:
    enp0s3:
      addresses: [192.168.1.77/24]
      routes:
        - to: default
          via: 192.168.1.254
      nameservers:
        addresses: [192.168.1.1]

Apply it with sudo netplan try (which rolls back automatically if you lose the connection) or sudo netplan apply. YAML is picky about indentation: use spaces, not tabs.

Red Hat ifcfg files (legacy)

/etc/sysconfig/network-scripts/ifcfg-enp0s3:

TYPE=Ethernet
BOOTPROTO=dhcp          # or none/static with IPADDR=, PREFIX=, GATEWAY=
NAME=enp0s3
DEVICE=enp0s3
ONBOOT=yes
IPV6INIT=yes
IPV6_AUTOCONF=yes

/etc/sysconfig/network holds system-wide values such as NETWORKING=yes, HOSTNAME=, and GATEWAY=.

Interface names

Names such as enp0s3 (Ethernet, PCI bus 0, slot 3) and wlp2s0 are predictable interface names. Older systems used eth0 and wlan0, and the book’s examples mix both styles. Always check the real name with ip link.

8. Host name and client-side DNS

Host name

$ hostname
$ hostnamectl
$ sudo hostnamectl set-hostname web01.example.edu
$ sudo hostnamectl set-hostname --pretty "Nick's lab server"

The static host name is stored in /etc/hostname (some systems use /etc/HOSTNAME). The “pretty” name is a friendly description that some tools display.

/etc/hosts

/etc/hosts holds local name-to-address mappings that work with no DNS at all:

127.0.0.1       localhost
127.0.1.1       web01.example.edu web01
192.168.1.200   mydatabase

/etc/resolv.conf

nameserver 192.168.1.1
nameserver 1.1.1.1
search example.edu lab.example.edu
  • nameserver is a DNS server to ask. Up to three are allowed, tried in order.
  • search lists domains appended to short names, so ping web01 tries web01.example.edu.
  • domain is the older single-domain form. Don’t combine domain and search; the last one listed wins.

On systems using systemd-resolved (Ubuntu and others), /etc/resolv.conf is usually a link to a stub file that points to 127.0.0.53. The real upstream servers are shown with resolvectl status. Change DNS through NetworkManager or Netplan rather than editing that file, which is regenerated.

/etc/nsswitch.conf

This file sets the order of lookup sources:

hosts:  files dns

files (/etc/hosts) is checked first, then DNS. If /etc/hosts has a stale entry, it overrides DNS, which is a classic source of confusing problems.

9. Graphical and text-menu tools: NetworkManager

NetworkManager is the default network service on most desktops and on Red Hat-family servers.

  • Desktop applet. An icon in the system tray (network blocks for wired, radio waves for wireless) lists available Wi-Fi networks and has an Edit Connections option for manual (static) or automatic (DHCP) settings. It saves the settings to the correct files for you.
  • nmtui is a text-menu version that works well over SSH.
  • nmcli is the full command-line interface:
$ nmcli                                   # summary of devices and addresses
$ nmcli device status
$ nmcli connection show
$ sudo nmcli connection add type ethernet con-name lab ifname enp0s3 \
       ipv4.method manual ipv4.addresses 192.168.1.77/24 \
       ipv4.gateway 192.168.1.254 ipv4.dns 192.168.1.1
$ sudo nmcli connection up lab
$ sudo nmcli connection modify lab ipv4.method auto   # switch to DHCP
$ nmcli device wifi list
$ sudo nmcli device wifi connect "MyNetwork" password "S3cure-pass"

The book’s short form (ip4 10.0.2.10/24 gw4 192.168.1.254) also works, but its example puts the gateway on a different subnet, which can’t work. The gateway must be inside the host’s own subnet.

10. The ip command (iproute2)

ip from the iproute2 package replaces ifconfig, route, and arp from net-tools. The syntax is ip [OBJECT] [COMMAND], and objects can be abbreviated (ip a means ip address show).

Object Manages
address (a) IPv4 and IPv6 addresses on interfaces
link (l) Interfaces themselves: up/down, MTU, MAC, bonds, bridges
route (r) Routing table
neighbor (n) ARP (IPv4) and NDP (IPv6) neighbor cache
rule Policy routing rules
netns Network namespaces (used by containers)
tunnel, tuntap, xfrm, maddress, monitor Tunnels, virtual TUN/TAP devices, IPsec, multicast addresses, event monitoring 
$ ip address show                          # or: ip a
$ ip -br address                           # brief one-line view
$ ip link show
$ ip route show                            # or: ip r
$ sudo ip address add 192.168.1.77/24 dev enp0s3
$ sudo ip route add default via 192.168.1.254 dev enp0s3
$ sudo ip link set enp0s3 up
$ sudo ip address del 192.168.1.77/24 dev enp0s3
$ ip neighbor

Reading ip address show:

  • lo is the loopback interface. Local programs can talk to each other over it as if they were on a network.
  • state UP and LOWER_UP mean the link is active and has a carrier.
  • link/ether is the MAC address.
  • inet 192.168.1.77/24 is the IPv4 address and prefix. dynamic means it came from DHCP.
  • inet6 fe80::…/64 scope link is the link-local IPv6 address. scope global marks a routable address.

Important: Changes made with ip take effect immediately but disappear at reboot. Make settings persistent with NetworkManager, Netplan, or the distribution’s configuration files.

Kernel network parameters

Kernel network settings live under /proc/sys/net/ and are set with sysctl:

$ sysctl net.ipv4.ip_forward
$ sudo sysctl -w net.ipv4.ip_forward=1                 # temporary
$ echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/90-forward.conf
$ sudo sysctl --system                                 # load the files
  • net.ipv4.ip_forward = 1 turns on routing between interfaces. 0 (the default) is right for an ordinary host.
  • net.ipv4.icmp_echo_ignore_broadcasts = 1 ignores broadcast pings (protection against smurf attacks). icmp_echo_ignore_all = 1 ignores all pings.
  • Persistent settings go in /etc/sysctl.conf or /etc/sysctl.d/*.conf.

11. Legacy tools (net-tools and wireless-tools)

These commands are still on the exam and on older servers. Know how to read them, and know what replaces each one.

Legacy Purpose Modern replacement
ifconfig Show and set addresses ip address, ip link
route Show and set routes ip route
netstat Connections, listening ports, statistics ss, ip -s link
arp Neighbor cache ip neighbor
iwconfig, iwlist Wireless settings and scanning iw, nmcli device wifi
ifup, ifdown Bring configured interfaces up or down nmcli connection up/down, ip link set 
$ ifconfig                                                # all interfaces
$ sudo ifconfig enp0s3 10.0.2.10 netmask 255.255.255.0 up
$ route -n                                                # routing table (numeric)
$ sudo route add default gw 192.168.1.254
$ sudo route add -net 10.20.0.0 netmask 255.255.0.0 gw 192.168.1.10
$ sudo route del default gw 192.168.1.254

In route output, the flag U means the route is up, G means it uses a gateway, and 0.0.0.0 (or default) is the default route. A route whose gateway is * or 0.0.0.0 is a directly connected network.

ethtool

ethtool shows or changes Ethernet link settings such as speed, duplex, auto-negotiation, and whether a link is detected. It’s the first tool for checking the physical layer.

$ ethtool enp0s3                  # Speed, Duplex, Auto-negotiation, Link detected
$ sudo ethtool -s enp0s3 speed 1000 duplex full autoneg off

Wireless

$ iwlist wlan0 scan                          # list nearby access points
$ sudo iwconfig wlan0 essid "MyNetwork" key s:password
  • s: means the key is given as ASCII text; without it the key is hexadecimal.
  • iwconfig keys work only with WEP. WPA2 and WPA3 need wpa_supplicant, which NetworkManager runs for you. In practice, use nmcli device wifi connect.

12. DHCP clients and servers

  • DHCP clients include dhclient (ISC, older), dhcpcd, and pump (obsolete). NetworkManager and systemd-networkd have built-in DHCP clients, so a separate client usually isn’t needed.
  • DHCP server: the ISC dhcpd server reads /etc/dhcp/dhcpd.conf (older systems use /etc/dhcpd.conf). ISC dhcpd has reached end of life; Kea is its successor.
subnet 10.0.2.0 netmask 255.255.255.0 {
    option routers              10.0.2.1;
    option subnet-mask          255.255.255.0;
    option domain-name          "lab.example.edu";
    option domain-name-servers  10.0.2.1;
    range 10.0.2.100 10.0.2.200;
}

The router and DNS server offered must be on the subnet being served. The book’s sample offers a 192.168 gateway to a 10.0.2.0 subnet, which wouldn’t work.

13. Bonding and bridging

Bonding (link aggregation) combines several NICs into one virtual interface for more bandwidth, fault tolerance, or both.

Mode Name Behavior
0 balance-rr Round-robin across links (load balancing and fault tolerance)
1 active-backup One link is active; another takes over if it fails (fault tolerance only, no switch configuration needed)
2 balance-xor Picks the link by a hash of source and destination addresses
3 broadcast Sends every packet on every link
4 802.3ad LACP aggregation (the switch must support it)
5 balance-tlb Adaptive transmit load balancing
6 balance-alb Adaptive load balancing for both transmit and receive 
$ sudo modprobe bonding
$ sudo ip link add bond0 type bond mode 802.3ad
$ sudo ip link set eth0 down && sudo ip link set eth0 master bond0
$ sudo ip link set eth1 down && sudo ip link set eth1 master bond0
$ sudo ip link set bond0 up
$ cat /proc/net/bonding/bond0          # status of the bond and its links

With NetworkManager, the persistent equivalent is nmcli connection add type bond ... plus bond-slave connections for each member interface.

Bridging connects interfaces at layer 2 so they act like one switch. It’s used to put virtual machines directly on the physical LAN.

$ sudo ip link add br0 type bridge
$ sudo ip link set enp0s3 master br0
$ bridge link                          # view bridge ports

brctl (bridge-utils) is the older command. Routing between networks (layer 3) is what requires net.ipv4.ip_forward = 1. The book ties that setting to bridging, but it’s a routing setting.

14. Basic troubleshooting

Work from the bottom layer up and change one thing at a time.

$ ip -br link                     # 1. Is the link up?
$ ip -br address                  # 2. Do I have the right address? (169.254.x.x = DHCP failed)
$ ip route                        # 3. Is there a default route?
$ ping -c 4 192.168.1.254         # 4. Can I reach the gateway?
$ ping -c 4 1.1.1.1               # 5. Can I reach the internet by address?
$ ping -c 4 example.com           # 6. Does name resolution work?
$ ss -tulpn                       # 7. Is the service listening, and on which address?

ping

  • ping sends ICMP echo requests and reports replies, round-trip times, and packet loss. It runs until Ctrl+C; use -c N to send N packets and stop.
  • IPv6: use ping -6 (or the older ping6). For a link-local address, name the interface with %: ping -6 fe80::c418:2ed0:aead:cbce%enp0s3.
  • No reply doesn’t prove the host is down. Many hosts and firewalls block ICMP. Try connecting to the service port instead.

traceroute and tracepath

  • traceroute lists each router (hop) on the path by sending probes with increasing time-to-live (TTL) values. Each router that drops a probe reports back, which reveals where traffic stops.
    • On Linux, traceroute sends UDP probes by default. -I uses ICMP and -T uses TCP, and those need root. The book says traceroute uses ICMP; that describes the -I option and the Windows tracert.
    • -n skips name lookups, which makes it faster.
  • tracepath traces the route with UDP, doesn’t need root, and also reports the path MTU (maximum transmission unit), which helps find links that can’t carry full-sized packets.
  • IPv6 versions are traceroute6 and tracepath6, or -6.
  • * * * means that hop didn’t answer, which is often a filter rather than a failure.

Name resolution tools

$ host www.linux.org
www.linux.org is an alias for linux.org.
linux.org has address 107.170.40.56
$ host 107.170.40.56          # reverse lookup (PTR record)
$ dig www.linux.org           # full answer, TTLs, and which server answered
$ dig linux.org MX            # a specific record type
$ dig @8.8.8.8 example.com    # ask a specific server
$ dig +short example.com
$ nslookup
> www.google.com
> server 1.1.1.1
> exit
$ getent hosts mydatabase     # follows nsswitch.conf, including /etc/hosts
$ resolvectl query example.com
  • host gives quick forward and reverse lookups. A name may return several addresses (load balancing) and an IPv6 address.
  • dig shows every section of a DNS response. Look for status: NOERROR versus NXDOMAIN, the ANSWER SECTION, and the SERVER: line. Common record types are A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail server), PTR (reverse), NS (name server), and TXT.
  • nslookup is interactive and can switch servers (server 1.1.1.1) to test whether your default DNS server is the problem.
  • getent hosts resolves names the way applications do, using nsswitch.conf. It checks /etc/hosts as well as DNS, while host and dig only query DNS.

Diagnostic question: ping 192.168.1.200 works, ping mydatabase fails, and getent hosts mydatabase returns the right address. What’s wrong? (The name is in /etc/hosts but not in DNS, or nsswitch.conf doesn’t check files. Compare the results of dig and getent.)

15. Advanced troubleshooting: sockets and ports

netstat (legacy)

$ netstat                  # open connections and UNIX sockets
$ netstat -t               # TCP only (-u for UDP)
$ netstat -l               # listening sockets only
$ netstat -tulpn           # TCP+UDP, listening, program names, numeric
$ netstat -s               # per-protocol statistics (IP, ICMP, TCP, UDP)
$ netstat -rn              # routing table

netstat shows port names from /etc/services (such as https and ipp) unless you add -n. unix entries are local interprocess sockets, not network traffic.

ss (current)

$ ss -tulpn                # listening TCP and UDP sockets, with processes
$ ss -anpt                 # all TCP sockets, numeric, with processes
$ ss -s                    # summary
$ ss -tn state established '( dport = :22 )'
Option Meaning
-t / -u TCP / UDP
-l / -a Listening only / all
-n Numeric (no name lookups)
-p Show the process (needs root to see other users’ processes)

Reading the Local Address column: 127.0.0.1:631 or [::1]:25 means the service accepts connections only from this host. 0.0.0.0:22 or *:22 means it listens on every interface. This column explains many “the service is running but I can’t connect” problems.

netcat (nc)

nc reads from and writes to any TCP or UDP port. It’s a “Swiss army knife” for testing.

server$ nc -l 2000                      # listen on TCP 2000 (-l -p 2000 on some versions)
client$ nc 192.168.1.77 2000            # connect; typed lines appear on the other end
$ nc -zv web01 22 80 443                # check whether ports are open
$ echo "test" | nc -u loghost 514       # send one UDP datagram

nc -zv host port is the best replacement for ping when ICMP is blocked. It tests exactly the port the application uses. Open test listeners only on lab networks and close them when you’re done.

Classroom application

  1. Document your network environment (Exercise 8.1, modernized). Record the output of ip address show (addresses, prefix, MAC), ip route (default gateway), resolvectl status or cat /etc/resolv.conf (DNS), and ss -tulpn (listening services). Confirm the gateway is on the same subnet as the address. On a machine with Wi-Fi, also run nmcli device wifi list.
  2. Subnet drills. For 172.20.14.77/20, find the network address, broadcast address, and host range. Then compress and expand several IPv6 addresses by hand.
  3. Static configuration with nmcli. On a lab VM, create a static connection, bring it up, verify it with ip, switch it back to DHCP, and reboot to prove that it persists. Then set an address with ip address add and reboot to show that it doesn’t.
  4. DNS break and fix. Add a wrong /etc/hosts entry for a real site and compare getent hosts, host, and ping results. Then remove it.
  5. Layered troubleshooting scenario. The instructor breaks one thing on a lab VM (interface down, wrong gateway, bad DNS server, or a service bound to 127.0.0.1). Students use the bottom-up checklist and name the failing layer before fixing it.
  6. Port testing. Start nc -l 2000 on one VM, connect from another, then block the port with the firewall and observe the difference between a refused connection and a timeout.

Common misconceptions

  • “If ping fails, the host is down.” ICMP is often blocked. Test the service port with nc -zv or ss.
  • “The gateway can be any router address.” It must be on the host’s own subnet.
  • “ip address add is permanent.” ip changes are lost at reboot. Use NetworkManager, Netplan, or configuration files for persistent settings.
  • “:: can be used anywhere to shorten zeros.” It can be used only once in an IPv6 address.
  • “Editing /etc/resolv.conf always works.” Under systemd-resolved or NetworkManager, that file is generated and your edits get overwritten.
  • “host/dig and the applications resolve names the same way.” Applications follow nsswitch.conf, which includes /etc/hosts. getent hosts shows what they will get.
  • “traceroute uses ICMP.” Linux traceroute sends UDP by default. tracepath also uses UDP and needs no root.
  • “WEP or WPA is fine for Wi-Fi.” WEP is broken. Use WPA2 or WPA3.
  • “ip_forward enables bridging.” It enables routing (layer 3). Bridges work at layer 2.
  • “A service listening on 127.0.0.1 is reachable from the network.” Only local clients can connect to a loopback-bound service.

Lesson summary

  • Model: physical → network (IP, ICMP) → transport (TCP, UDP, ports) → application. Troubleshoot from the bottom up.
  • Addressing: IPv4 uses 32 bits with netmask or CIDR notation, private ranges, and NAT. IPv6 uses 128 bits with :: compression, link-local fe80::, and global addresses. A host needs an address, mask, gateway, host name, and DNS server.
  • Persistent configuration depends on the distribution: /etc/network/interfaces, Netplan, ifcfg files or NetworkManager keyfiles, and systemd-networkd. Use nmcli/nmtui or Netplan to configure, and ip to inspect and make temporary changes.
  • Names: use hostnamectl and /etc/hostname for the host name, /etc/hosts for local entries, /etc/resolv.conf or resolvectl for DNS servers, and /etc/nsswitch.conf for lookup order.
  • Legacy tools (ifconfig, route, netstat, iwconfig) map to ip, ss, and iw/nmcli. ethtool checks the physical link.
  • Troubleshooting tools: ping, traceroute/tracepath, host/dig/nslookup/getent, netstat/ss, and nc. Bonding and bridging combine or join interfaces.

The next lesson is Writing Scripts.