Handbooks / Linux / Chapter 5

Networking Commands

7 pages · ~5 min✓ Reviewed

Builds on Processes and Signals.

LinuxPage 1

Mental Model and Debug Order

1. Layers and Sockets

  1. IP on interfaceip
  2. Routegateway
  3. DNSdig
  4. Portss, curl
  5. Firewallallows it
  • Debug bottom-up in that order
  • Socket = IP + port + protocol
  • Service LISTENs; client uses a random ephemeral port
  • Ephemeral range: 32768-60999

2. Bind Address

BindReachable from
127.0.0.1local only
0.0.0.0all IPv4 interfaces
::all IPv6 interfaces
Works locally, fails remotely

Usually a loopback bind.

3. Can't Connect? Check in Order

  1. 1ip addrhave an IP?
  2. 2ip routedefault gateway?
  3. 3ping 8.8.8.8internet by IP?
  4. 4dig example.comDNS?
  5. 5curl -vservice answers?

4. Interview Point

  • Works on localhost only? Check the bind address, then the firewall
  • Ping IP works, name fails? The DNS layer
  • Listening vs open? Listening = process bound; open = also reachable through the firewall
LinuxPage 2

ip and ss: Interfaces, Routes and Listeners

1. Interfaces and routes

CommandShows
ip -br aone line per interface: address, UP/DOWN
ip linklayer 2: state, MAC
ip routethe routing table
ip route get 8.8.8.8route and source IP a packet would use
  • default via X dev eth0 = the gateway, used when no other route matches

2. Sockets with ss

  • ss replaces netstat
  • -tulpn = TCP, UDP, Listening, Process, Numeric
  • Without sudo, other users' processes are hidden
bash
sudo ss -tulpn
ss -tn state established
ss -tn 'sport = :443'

listeners, live connections, filter by port

output
tcp LISTEN 127.0.0.1:5432 users:(("postgres",pid=812))
tcp LISTEN 0.0.0.0:8080 users:(("node",pid=2210))
Local Address:PortReachable from
127.0.0.1:5432local only
0.0.0.0:5432 or *:5432public

3. Interview Point

  • Who listens on 8080? sudo ss -tulpn | grep :8080
  • Interface and gateway for an IP? ip route get IP
  • Why ss over netstat? It queries the kernel via netlink, faster; netstat is deprecated
LinuxPage 3

ping, curl, wget and dig in Practice

1. ping: Reachability

  • ping -c 4 host sends 4 ICMP echo requests
  • Shows reachability, packet loss, RTT
Failed ping

ICMP can be blocked: a failed ping does not prove the host is down.

2. curl Flags

FlagDoes
-vDNS, connect, TLS, headers
-Iheaders only
-sno progress meter
-o filesave to file
-Lfollow redirects
-kskip cert check, testing only
-X -H -dmethod, header, JSON body
-w '%{http_code}'print status code
--connect-timeout 5cap a hung connect
bash
curl -s -X POST \
  -H 'Content-Type: application/json' \
  -d '{"a":1}' \
  -w '%{http_code}' --connect-timeout 5 URL

JSON POST, prints status code

3. curl vs wget

curlwget
Usesingle requests, APIsdownload files
Outputstdout by defaultdisk
Extras-o saves-c resumes, -r mirrors

4. dig

  • dig example.com A +short: just the answer
  • dig @8.8.8.8 example.com: bypasses the local resolver
  • dig -x IP: reverse lookup
  • Types: A, AAAA, CNAME, MX, TXT, NS
LinuxPage 4

ssh, scp and Firewall Basics

1. Connect with ssh

  • Custom port and key: -p 2222 -i key
  • Private key must be chmod 600, or ssh refuses it
  • ~/.ssh/config entries let you type ssh web
  • Add ProxyJump bastion to hop via a jump host
bash
chmod 600 ~/.ssh/key
ssh user@host -p 2222 -i ~/.ssh/key
text
Host web
  HostName 10.0.0.5
  User deploy
  Port 2222
  IdentityFile ~/.ssh/key
  ProxyJump bastion

~/.ssh/config

2. Copy and tunnel

TaskCommand
Upscp file user@host:/path
Downscp user@host:/path/file .
Directoryscp -r
Port-P capital (ssh uses -p)
Repeat syncrsync -av
  • Tunnel: ssh -L 8080:localhost:80 user@host
  • ssh -v debugs auth failures
  • Prefer key auth: server holds the public key, you sign a challenge

3. Firewall basics

ToolWhat it is
ufwUbuntu front end: ufw allow 22/tcp
firewalldRHEL zones: firewall-cmd
iptables/nftablesKernel rules, first match wins
Timeout vs refused

Timeout = packets dropped (firewall). Refused = host answered, nothing listens on that port.

LinuxPage 5

Common Mistakes

1. Timeout vs Refused

SymptomMeansCheck
RefusedHost answered, nothing listensss -tulpn
TimeoutFirewall or security group drops packets, or bad routeip route get IP

2. Layers, Lockouts, DNS

  • ufw allow 8080 alone: cloud security group or router still blocks
  • Bound to 127.0.0.1: unreachable either way
  • Default deny before ufw allow 22 locks you out
  • iptables is first-match, lost on reboot unless saved
  • Cached DNS answer: check dig @8.8.8.8 and the TTL
  • Ping by name works, port may still be closed

3. Small Slips

WrongRight
scp -p 2222scp -P 2222
ss without sudosudo ss: shows process names
curl -k in prodTesting only; fix the cert
bash
nc -zv host 22
output
Connection to host 22 port [tcp/ssh] succeeded!
Open port?

Use nc -zv host port, not ping.

LinuxPage 6

Cheat Sheet

1. Interfaces and sockets

CommandShows
ip -br abrief addresses, UP/DOWN
ip linkL2 state, MAC
ip routerouting table, gateway
ip route get IProute + source IP
ss -tulpnlisteners + process
ss -tn state establishedlive connections
sudo lsof -i :PORTprocess on port

2. Reachability and DNS

  • ICMP can be blocked: a failed ping is not proof the host is down
bash
ping -c 4 host
nc -zv host port
curl -v URL
curl -sI URL
curl -w '%{http_code}' -o /dev/null -s URL
CommandAnswers
dig example.com +shortbare answer
dig @8.8.8.8 example.comspecific resolver
dig -x IPreverse lookup
dig example.com MXmail records

3. Remote and firewall

  • ssh port is -p, scp port is -P
  • -L forwards local 8080 to remote port 80
bash
ssh -i key -p PORT user@host
scp -P PORT -r dir user@host:/path
ssh -L 8080:localhost:80 host
sudo ufw allow 22/tcp
sudo ufw enable
sudo ufw status numbered
Lockout

Run ufw allow 22/tcp before ufw enable.

LinuxPage 7

Check yourself

ss -tulpn shows 127.0.0.1:5432 LISTEN. A client on another host connects to port 5432. What happens, and what is the fix?
  • Connection refused: nothing listens on the server's external IP
  • Rebind to 0.0.0.0, then check the firewall
ping 8.8.8.8 works but ping example.com fails. Which layer is broken, and what do you run next?
  • DNS resolution, since routing and internet access work
  • Run dig example.com and compare with dig @8.8.8.8 example.com
Spot the bug: scp -p 2222 app.tar user@host:/tmp. Why does it fail?
  • Lowercase -p preserves timestamps, so 2222 is read as a file name
  • scp needs capital -P 2222 for the port