GO KALI FREE
BeginnerLinux

Linux Networking Basics: Commands and Configuration

Essential Linux networking commands and configuration for IP addressing, routing, DNS, firewall rules, and network troubleshooting.

#Linux networking#IP#routing#network commands#network configuration

Linux Networking Overview

Linux networking is powerful and flexible. Every Linux system can function as a client, server, router, firewall, or bridge. Understanding Linux networking commands is essential for system administration and cybersecurity.

Prerequisites

Basic Linux command line skills. Understanding of IP addresses and ports.

Network Interface Configuration

ip addr show              # View IP addresses (modern)
ip link show              # View interfaces
ip route show             # View routing table
ifconfig                  # Legacy alternative
iwconfig                  # Wireless interfaces

Configuring IP Addresses

sudo ip addr add 192.168.1.100/24 dev eth0
sudo ip link set eth0 up
sudo ip addr del 192.168.1.100/24 dev eth0

DNS Configuration

cat /etc/resolv.conf
# nameserver 8.8.8.8
# nameserver 1.1.1.1

nslookup google.com
dig google.com
host google.com

Network Diagnostics

ping -c 4 google.com            # Test connectivity
traceroute google.com           # Trace network path
traceroute -I google.com        # Use ICMP instead of UDP
ss -tulpn                       # Listening ports (modern)
netstat -tulpn                  # Listening ports (legacy)
nc -zv 192.168.1.1 22 80 443   # Test TCP ports
curl -I https://example.com     # HTTP request

Packet Capture

sudo tcpdump -i eth0                        # All traffic
sudo tcpdump -i eth0 port 80                # HTTP traffic
sudo tcpdump -i eth0 host 192.168.1.100     # Specific host
sudo tcpdump -i eth0 -w capture.pcap        # Save to file
tcpdump -r capture.pcap                     # Read capture file
sudo tcpdump -c 100 -i eth0                # Limit to 100 packets

Firewall Management

iptables

sudo iptables -L -n -v                     # View rules
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A INPUT -j DROP             # Default deny
sudo iptables-save > /etc/iptables/rules.v4

ufw (Simple Firewall)

sudo ufw enable
sudo ufw allow ssh
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw status verbose

Persistent Network Configuration

Netplan (Modern)

# /etc/netplan/01-netcfg.yaml
network:
  version: 2
  ethernets:
    eth0:
      addresses: [192.168.1.100/24]
      gateway4: 192.168.1.1
      nameservers:
        addresses: [8.8.8.8, 1.1.1.1]

sudo netplan apply

Real-World Examples

Find public IP: curl -s ifconfig.me

Check service on port: sudo lsof -i :80

Test throughput: iperf3 -c server-ip

Monitor bandwidth: nload or iftop

Common Mistakes

Using ifconfig on modern systems (use ip). Forgetting sudo for packet capture. Having multiple default gateways. Opening too many firewall ports.

Best Practices

Use iproute2 suite (ip,ss) over legacy tools. Document network changes. Use persistent config (Netplan). Default deny firewall rules. Monitor traffic for anomalies.

Related Tools

nmap — Network discovery. tcpdump — Packet capture. Wireshark — Graphical analysis. iperf3 — Bandwidth testing. nload — Bandwidth monitoring.

Related Articles

  • networking-basics
  • nmap-beginner-tutorial
  • network-scanning-nmap-beginners
  • firewall-fundamentals
  • ssh-fundamentals

    • Summary

    Linux networking commands provide control over interfaces, routing, DNS, firewalls, and traffic analysis. Key commands: ip (interfaces), ss (sockets), ping (connectivity), tcpdump (packet capture), iptables/ufw (firewall).

    Knowledge Check

  • What command shows all network interfaces and IPs?
  • How do you test connectivity to a remote host?
  • What is the difference between `ss` and `netstat`?
  • How do you capture HTTP traffic with tcpdump?
  • What command allows SSH through iptables?

    • Frequently Asked Questions

    What is the difference between ip and ifconfig?

    ip (from iproute2) is the modern replacement for ifconfig. Use `ip addr show` instead of `ifconfig`, `ip link show` for interfaces, and `ip route show` for routing. ifconfig is deprecated on most distributions and lacks support for modern networking features like network namespaces.

    How do I check which ports are listening on my system?

    Use `ss -tulpn` to list all listening TCP and UDP ports with their process IDs. The -t flag shows TCP, -u shows UDP, -l shows listening, -p shows process, and -n prevents DNS resolution. Alternatively, `netstat -tulpn` works on older systems.

    How do I capture and analyze network traffic with tcpdump?

    Use `sudo tcpdump -i eth0` for all traffic on an interface, `sudo tcpdump -i eth0 port 80` for HTTP only, or `sudo tcpdump -i eth0 -w capture.pcap` to save to a file for Wireshark analysis. Add `-c 100` to limit packet count and `-n` to skip DNS resolution.

    What is the difference between ufw and iptables?

    ufw (Uncomplicated Firewall) is a user-friendly frontend for iptables/nftables. Use `ufw allow ssh` instead of writing raw iptables rules. ufw is simpler for basic firewall configuration, while iptables/nftables provide granular control for complex rules. See our [firewall guide](/learn/firewall-fundamentals) for details.

    How do I configure a static IP address on Linux?

    With Netplan (modern Ubuntu), edit /etc/netplan/01-netcfg.yaml with addresses, gateway4, and nameservers, then run `sudo netplan apply`. For older systems, edit /etc/network/interfaces. Use `ip addr add 192.168.1.100/24 dev eth0` for temporary configuration.

    How do I test network connectivity between two hosts?

    Use `ping -c 4 host` for basic ICMP connectivity, `traceroute host` to see the packet path, and `curl -I https://host` to test HTTP connectivity. For port-specific testing, use `nc -zv host 22` or `nmap -p 22 host`. Combine tools to isolate connectivity issues.

    How do I find my public IP address from the command line?

    Use `curl -s ifconfig.me` or `curl -s icanhazip.com` to query an external service. For local IP, use `ip addr show` and look for your interface's inet address. Use `hostname -I` to display all local IP addresses without the interface details.

    How do I configure DNS resolution on Linux?

    DNS servers are configured in /etc/resolv.conf with entries like `nameserver 8.8.8.8`. Test with `dig example.com` or `nslookup example.com`. For persistent configuration on systemd systems, use `systemd-resolve --set-dns=8.8.8.8 --interface=eth0`.

    How do I set up a basic firewall with ufw?

    Install with `sudo apt install ufw`, enable with `sudo ufw enable`, then add rules: `sudo ufw allow ssh`, `sudo ufw allow 80/tcp`, `sudo ufw allow 443/tcp`. Check status with `sudo ufw status verbose`. The default policy denies all incoming and allows all outgoing traffic.

    What is the difference between ss and netstat?

    ss (socket statistics) is the modern replacement for netstat, part of the iproute2 suite. It's faster, shows more TCP state information, and handles large numbers of connections better. Use `ss -tulpn` instead of `netstat -tulpn` — the flags are nearly identical.

    How do I monitor bandwidth usage on Linux?

    Use `nload` for real-time interface bandwidth graphs, `iftop` for per-connection bandwidth, or `nethogs` for per-process network usage. Install with `sudo apt install nload iftop nethogs`. For packet-level analysis, combine tcpdump with Wireshark for deep inspection.

    How do I test network throughput between two machines?

    Install iperf3 on both machines (`sudo apt install iperf3`), run `iperf3 -s` on the server and `iperf3 -c server-ip` on the client. This measures TCP/UDP throughput between the two hosts. Use `-t 30` for a 30-second test and `-P 4` for parallel streams.