Linux Networking Fundamentals

Linux Networking Fundamentals

Linux networking is built on the same TCP/IP stack that powers the internet. As a sysadmin, you need to understand how packets flow through the system: from the network interface card through the kernel's networking stack to the application, and back out. This mental model helps you know where to look when things go wrong — whether the problem is at the interface, the routing table, the firewall, or the application itself.

Network interfaces

Interface types on Ubuntu:
  eth0, ens3, enp3s0    — Physical Ethernet (naming varies by driver)
  lo                    — Loopback (127.0.0.1, always up, used for local comms)
  wlan0, wlp2s0         — Wireless
  docker0, virbr0       — Virtual bridge (created by Docker, libvirt)
  veth0                 — Virtual Ethernet pair (containers use these)
  bond0                 — Bonded interface
  vlan10                — VLAN interface

# List all network interfaces and their addresses
ip addr show
ip a    # Short form

# Show a specific interface
ip addr show ens3

# Show interface status (up/down, speed, duplex)
ip link show

# Show only interfaces that are UP
ip link show up

ip addr show output

2: ens3:  mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.10/24 brd 192.168.1.255 scope global ens3
       valid_lft forever preferred_lft forever
    inet6 fe80::5054:ff:fe12:3456/64 scope link
       valid_lft forever preferred_lft forever

How a packet travels through Linux

Outbound packet path:
  Application
      ↓ socket write
  TCP/UDP layer (adds port numbers)
      ↓
  IP layer (adds source/destination IP, looks up routing table)
      ↓
  Netfilter (iptables/nftables — firewall, NAT)
      ↓
  Network driver
      ↓
  NIC hardware → wire

Inbound packet path is the reverse. At each layer, the kernel can:
  - Accept and forward to next layer
  - Drop (firewall rule)
  - Redirect (NAT, policy routing)

MAC addresses and ARP

# MAC address: Layer 2 identifier, unique to each NIC
# Used to deliver frames on the LOCAL network segment
# ARP: resolves "what MAC address has IP 192.168.1.1?"

# View the ARP cache (IP → MAC mappings for hosts on your local segment)
ip neigh show
arp -n    # Alternative, older command

ip neigh show output

192.168.1.1 dev ens3 lladdr 52:54:00:ab:cd:ef REACHABLE
192.168.1.20 dev ens3 lladdr 08:00:27:11:22:33 STALE

# If you can ping a host but cannot reach it by name, ARP is likely working
# If you cannot ping at all, check if ARP entry exists for the gateway

Essential networking commands

# ip — the modern all-in-one network tool (replaces ifconfig, route, arp)
ip addr     # IP addresses
ip link     # Interface state/settings
ip route    # Routing table
ip neigh    # ARP table
ip rule     # Policy routing rules

# Show the routing table
ip route show

ip route show output

default via 192.168.1.1 dev ens3 proto dhcp src 192.168.1.10 metric 100
192.168.1.0/24 dev ens3 proto kernel scope link src 192.168.1.10

# Show which interface a packet to a specific destination would use
ip route get 8.8.8.8

ip route get output

8.8.8.8 via 192.168.1.1 dev ens3 src 192.168.1.10 uid 1000
    cache

# ss — socket statistics (replaces netstat)
ss -tuln    # TCP and UDP listening sockets
ss -tunap   # All connections with process names (requires root)

Conclusion

The key networking tools on modern Ubuntu are: ip addr for interface addresses, ip link for interface state, ip route for routing, ip neigh for ARP cache, and ss -tuln for open ports. The old commands (ifconfig, netstat, route) still work but are deprecated — the ip suite provides richer output and handles modern features like multiple addresses per interface and policy routing. Understanding the packet path through the kernel helps you pinpoint where a connectivity problem is occurring.