Chapter 8: Linux Networking Fundamentals

OSI Model Quick Reference

Understanding layers helps troubleshoot network issues:

TCP vs UDP Comparison

TCP does not "guarantee" delivery in an absolute sense — if the network stays broken, the connection eventually fails. What it provides is a reliable, ordered stream: within a working connection, data arrives in order and lost segments are retransmitted. UDP has lower overhead, which often makes it feel faster, but it is not automatically faster; on a congested link its lack of flow and congestion control can actually hurt throughput.

Common Ports Reference

1. Linux Networking Architecture

Application ──► TCP / UDP ──► IP Layer ──► Network Interface ──► Physical Network
              

Linux networking is layered, allowing applications to communicate reliably across local and remote networks.

2. Network Interfaces

ip link
ip addr
ip -br addr
hostname -I

3. IP Addressing

CIDR notation combines the IP address with the network prefix length, replacing traditional subnet mask notation. The three private ranges defined by RFC 1918 — 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 — are reserved for internal networks and are not routable on the public internet.

4. Viewing Network Information

5. DNS Basics

Query DNS directly with dig to see exactly what the resolver returns:

dig example.com               # full answer for the A record
dig +short example.com        # just the IP address(es)
dig example.com MX            # mail (MX) records
dig +short -x 93.184.216.34   # reverse lookup (IP to name)
nslookup example.com          # simpler, interactive alternative

On systems running systemd-resolved, resolvectl status shows which DNS servers each interface is using and resolvectl query example.com resolves a name through that service.

6. Linux vs IBM AIX

7. Hands-on Practice

1. List all interfaces using ip link.
2. Display IP addresses with ip addr.
3. Show routing information.
4. View listening ports.
5. Inspect /etc/resolv.conf and /etc/hosts.

8. Common Mistakes

• Confusing IP addresses with hostnames.
• Ignoring the default gateway.
• Editing DNS files without backups.
• Overlooking IPv6 configuration.

9. Part 1 Summary

10. Connectivity Testing (ping, traceroute)

ping -c 4 google.com
traceroute google.com
tracepath google.com

ping tests basic IP connectivity, and traceroute/tracepath show the route packets take to a host. Remember that ping uses ICMP, which many firewalls and cloud providers block — a failed ping does not always mean the host is down. Confirm another way: test DNS with dig +short host, probe the application with curl -I https://host, or use nc -vz host 443 for a TCP port check. On the server itself, ss -tuln only shows whether a service is listening locally — it does not prove remote reachability.

11. Routing & Default Gateways

12. Network Configuration (nmcli, curl)

nmcli is the command-line front end for NetworkManager, which manages interfaces and connections on most desktop and RHEL-family systems. Not every system uses NetworkManager: some servers use systemd-networkd, and Debian/Ubuntu server installs often use Netplan (which renders to either backend). Check what is active with systemctl status NetworkManager before relying on nmcli. Use curl and wget to test HTTP endpoints and download files:

nmcli device status       # per-interface state (NetworkManager)
nmcli connection show     # configured connection profiles
curl -I https://example.com   # fetch just the HTTP response headers
wget https://example.com/file.zip  # download a file

13. OpenSSH Remote Administration (ssh, scp, sftp)

SSH encrypts remote administration sessions. Edit /etc/ssh/sshd_config, validate the syntax with sshd -t, then reload the service so the new settings take effect.

ssh user@server.example.com                 # open a remote shell
scp report.txt user@server.example.com:/tmp/ # copy a file to the server
sftp user@server.example.com                # interactive file transfer session
sudo systemctl reload sshd                   # RHEL/Rocky/Fedora unit name

# Common hardening directives in /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no

Where key-based login is available, set those directives, run sshd -t, then reload. Keep a second session open so a bad change does not lock you out.

14. Firewall Basics (ufw, firewalld)

Both UFW and firewalld are friendly front ends to the kernel's netfilter/nftables packet filter; you rarely need to write raw rules by hand. Use the tool your distribution ships with.

Debian / Ubuntu (UFW):

sudo ufw status
sudo ufw allow OpenSSH
sudo ufw enable

RHEL / Rocky / AlmaLinux / Fedora (firewalld):

sudo firewall-cmd --state
sudo firewall-cmd --add-service=ssh --permanent   # allow SSH across reboots
sudo firewall-cmd --reload                        # apply permanent rules
sudo firewall-cmd --list-all                      # show the active zone's rules

With firewalld, changes made without --permanent apply immediately but are lost on reload/reboot; adding --permanent then --reload makes them persist. Both tools ultimately program nftables underneath.

15. Production Networking Troubleshooting

Commands Covered in This Chapter

• ip — show and configure interfaces, addresses, and routes
• ping — test reachability with ICMP
• traceroute — show the path packets take to a host
• ss — list sockets and listening ports (modern netstat)
• dig / nslookup — query DNS
• nmcli — manage NetworkManager connections
• ssh / scp / sftp — remote login and file transfer
• curl / wget — fetch URLs and download files
• ufw / firewall-cmd — manage firewall rules (UFW and firewalld)