$ run as a normal user# run as root (or with sudo)
Skills in this chapter
- Check addresses, routes, ports and names
Know the layers of TCP/IP
Network data travels in layers. Each layer has one job. When something fails, check the layers from the bottom up.
Understand IPv4 addresses
An IPv4 address has 4 numbers (0–255). The prefix (/24) says how much of it is the network part. Machines in the same network talk directly; others go through the gateway.
192.168.122.10/24
└────┬────┘ └┬┘
network host → network 192.168.122.0, 254 usable addresses (.1 – .254)| Prefix | Netmask | Addresses for hosts |
|---|---|---|
/24 | 255.255.255.0 | 254 |
/16 | 255.255.0.0 | 65,534 |
/8 | 255.0.0.0 | about 16 million |
/30 | 255.255.255.252 | 2 (point-to-point links) |
| Range | What it is |
|---|---|
10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 | Private networks (not routed on the internet) |
127.0.0.0/8 | Loopback: the machine itself (127.0.0.1) |
169.254.0.0/16 | Link-local: the machine found no DHCP server |
Understand IPv6 addresses
IPv6 addresses are 128 bits long, written in 8 groups of hex numbers. Leading zeros can go, and one run of zero groups can be written as ::.
2001:0db8:0000:0010:0000:0000:0000:0010 full
2001:db8:0:10::10 short| Address | Meaning |
|---|---|
::1 | Loopback (like 127.0.0.1) |
fe80::/10 | Link-local: always there on every card, only for the local network |
2000::/3 | Global addresses (internet) |
fd00::/8 | Unique local: private networks |
/64 | The normal prefix of a local IPv6 network |
Show addresses and cards
ip is the tool to read (and change for now) the network of the kernel.
ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
link/ether 52:54:00:3a:1b:2c brd ff:ff:ff:ff:ff:ff
ip -br link
ip addr show enp1s0
ip -br a
lo UNKNOWN 127.0.0.1/8 ::1/128
enp1s0 UP 192.168.122.10/24 fe80::5054:ff:fe3a:1b2c/64
ip -s link show enp1s0Card names like enp1s0 are predictable names: en = Ethernet, p1 = PCI bus 1, s0 = slot 0. wl… = Wi-Fi.
Remember
ip -br a gives a short table with every card and its addresses. It is the first command in every network problem.
Check the routes and the gateway
The routing table says where packets go. The default route points to the gateway for all other networks.
ip route
default via 192.168.122.1 dev enp1s0 proto static metric 100
192.168.122.0/24 dev enp1s0 proto kernel scope link src 192.168.122.10 metric 100
ip -6 route
ip route get 8.8.8.8
8.8.8.8 via 192.168.122.1 dev enp1s0 src 192.168.122.10 uid 1000ip route get ADDRESS shows which way the kernel would choose for that address.
Test the connection
Test step by step: the gateway, then a far address, then a name. The first step that fails shows the broken layer.
ping -c 3 192.168.122.1
ping -c 3 8.8.8.8
ping -c 3 access.redhat.com
ping -6 -c 3 2001:db8:10::1
tracepath access.redhat.com
tracepath -n 8.8.8.8| Result | Most likely problem |
|---|---|
| Gateway does not answer | Cable, card, address or prefix wrong |
| Gateway OK, far address fails | Default route missing or wrong, or a firewall |
| Address OK, name fails | DNS (name server) problem |
Note
Some networks block ping (ICMP). No answer to ping does not always mean the host is down — test the real port too: curl -I https://HOST.
Check ports and services
ss lists the open ports and the connections. A service must listen on a port before clients can connect.
ss -tln
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 511 *:80 *:*
LISTEN 0 244 127.0.0.1:5432 0.0.0.0:*
ss -tlpn
ss -tn state established
ss -uln
grep -w 443 /etc/services
https 443/tcp| Option | Meaning |
|---|---|
-t / -u | TCP / UDP |
-l | Only listening ports |
-n | Numbers, not names |
-p | Show the program (needs root to see all) |
Remember
0.0.0.0:22 or *:80 = open on all addresses. 127.0.0.1:5432 = only reachable from the machine itself.
Check names and DNS
Names are turned into addresses by /etc/hosts first, then by the DNS servers in /etc/resolv.conf.
cat /etc/hosts
127.0.0.1 localhost localhost.localdomain
192.168.122.20 server2.example.com server2
cat /etc/resolv.conf
search example.com
nameserver 192.168.122.1
getent hosts server2
192.168.122.20 server2.example.com server2
host access.redhat.com
dig +short access.redhat.com
hostname
server1.example.comgetent hosts NAMEasks like a normal program does: hosts file and DNS. Best test for "can programs find this name?".digandhostask only DNS (packagebind-utils).
Next: change all of this in a lasting way — Set up the network.