Linux Networking: A Practical Guide

Linux Linux 7 min read 1490 words Beginner ExcellentWiki Editorial Team

Linux networking tools are essential for diagnosing connectivity issues, monitoring traffic, and configuring network interfaces. This guide covers the modern toolset (iproute2) and classic utilities.

Network Interface Configuration

Modern Tools (iproute2)

# List all network interfaces
ip link show

# Show IP addresses
ip addr show
ip addr show eth0

# Show routing table
ip route show
ip route get 8.8.8.8   # trace route for destination

# Bring interface up/down
ip link set eth0 up
ip link set eth0 down

# Add IP address
ip addr add 192.168.1.100/24 dev eth0

# Remove IP address
ip addr del 192.168.1.100/24 dev eth0

# Add default gateway
ip route add default via 192.168.1.1

# Show neighbour table (ARP cache)
ip neigh show

Legacy Tools (ifconfig, route)

ifconfig                    # show interfaces
ifconfig eth0 192.168.1.100 netmask 255.255.255.0 up

route -n                    # show routing table
route add default gw 192.168.1.1

The iproute2 suite (ip, ss, bridge) is the modern replacement for ifconfig, route, netstat, and arp. It is actively maintained and supports advanced features like namespaces and VRF.

Connection Monitoring

ss (Socket Statistics)

# Show all listening sockets
ss -tlnp     # TCP, listening, numeric, process
ss -ulnp     # UDP, listening, numeric, process

# Show established connections
ss -tunp     # TCP+UDP, numeric, process

# Show connections by port
ss -tlnp sport = :80
ss -tlnp dport = :443

# Show process using a port
ss -tlnp | grep :8080

# Summary statistics
ss -s

netstat (Legacy)

netstat -tlnp     # TCP listening
netstat -ulnp     # UDP listening
netstat -s        # protocol statistics
netstat -i        # interface statistics

DNS Resolution

# Query DNS
nslookup example.com
dig example.com
dig +short example.com          # short output
dig -x 8.8.8.8                  # reverse lookup
dig example.com ANY             # all record types
dig @1.1.1.1 example.com        # use specific DNS server

# Query system resolver
host example.com
getent hosts example.com         # uses /etc/nsswitch.conf

# Check DNS configuration
cat /etc/resolv.conf
systemd-resolve --status        # systemd-resolved status
resolvectl status               # newer systemd

DNS Troubleshooting

# Test specific DNS server
dig @8.8.8.8 example.com

# Check if DNS resolution is working
time getent hosts google.com    # slow = DNS issue

# Flush DNS cache (systemd-resolved)
sudo resolvectl flush-caches

# Check hosts file
cat /etc/hosts

Connectivity Testing

# Ping (ICMP echo)
ping -c 4 8.8.8.8               # send 4 packets
ping -c 4 -i 0.2 example.com    # 200ms interval (faster test)

# Trace route
traceroute example.com
mtr example.com                  # continuous traceroute (combines ping + traceroute)

# Port connectivity
nc -zv example.com 80           # test TCP port (netcat)
nc -zv example.com 443
nc -zuv example.com 53          # test UDP port

# Using timeout
timeout 5 bash -c 'echo > /dev/tcp/example.com/80' && echo "Port open"

# Check if local port is in use
ss -tlnp | grep 8080
lsof -i :8080

# HTTP request
curl -I https://example.com     # get headers only
curl -v https://example.com     # verbose (full request/response)
curl --resolve example.com:443:127.0.0.1 https://example.com  # override DNS

Packet Capture

tcpdump

# Capture on interface
tcpdump -i eth0

# Limit capture count
tcpdump -c 100 -i eth0

# Filter by port
tcpdump -i eth0 port 80
tcpdump -i eth0 port 443
tcpdump -i eth0 portrange 8000-9000

# Filter by host
tcpdump -i eth0 host 192.168.1.1
tcpdump -i eth0 src 192.168.1.100
tcpdump -i eth0 dst 192.168.1.100

# Filter by protocol
tcpdump -i eth0 icmp            # ping packets
tcpdump -i eth0 arp             # ARP traffic
tcpdump -i eth0 tcp             # all TCP traffic

# Complex filters
tcpdump -i eth0 'tcp[tcpflags] & (tcp-syn) != 0 and tcp[tcpflags] & (tcp-ack) == 0'  # SYN packets only

# Read from saved file
tcpdump -r capture.pcap

# Write to file (for analysis)
tcpdump -i eth0 -w capture.pcap port 80

# Human-readable output
tcpdump -i eth0 -A port 80      # ASCII (HTTP payloads)
tcpdump -i eth0 -X port 80      # hex + ASCII

Bandwidth and Throughput

# Interface throughput
iftop -i eth0                    # top-like bandwidth monitor
nload                            # per-interface traffic graph
bmon                             # bandwidth monitor

# Check interface speed
ethtool eth0                     # shows speed, duplex, negotiated settings

# Test bandwidth (requires iperf3 server)
iperf3 -c speedtest.example.com -p 5201
iperf3 -c speedtest.example.com -t 30 -P 4   # 30 seconds, 4 parallel streams

# Network statistics per interface
ip -s link show eth0             # TX/RX packets, errors, drops

# Check for interface errors
ip -s -s link show eth0         # more detail

Firewall (iptables/nftables)

# List rules (iptables)
sudo iptables -L -n -v
sudo iptables -t nat -L -n -v

# List rules (nftables — modern replacement)
sudo nft list ruleset

# Quick check firewall status
sudo ufw status verbose         # Ubuntu
sudo firewall-cmd --list-all    # RHEL/CentOS

Real-World Implementation Tips

Production Considerations

When moving from development to production, several factors become critical. Error handling should be comprehensive — every external call (database, API, file system) should have proper error checking, logging, and retry logic where appropriate. Performance monitoring through metrics and structured logging helps identify bottlenecks before they affect users.

Testing Strategy

A thorough testing approach combines multiple levels:

Unit tests verify individual functions and methods in isolation
Integration tests validate that components work together correctly
Edge case tests cover boundary conditions, empty inputs, and error states
Performance tests ensure the system meets latency and throughput requirements

Test data should be realistic but controlled. Mock external dependencies to make tests fast and deterministic. Aim for tests that are independent, repeatable, and fast enough to run on every commit.

Documentation

Good documentation is essential for maintainable code. Follow these principles:

Document the “why” not just the “what” — explain design decisions
Keep examples up to date with the code
Include usage examples for public APIs
Document configuration options and their defaults
Explain error conditions and recovery strategies

Security Best Practices

Security should be considered throughout development:

Validate all inputs at system boundaries
Use parameterized queries for database access
Store secrets in environment variables or secret managers
Keep dependencies updated to patch vulnerabilities
Apply the principle of least privilege

Performance Optimization

Optimize based on measured data, not assumptions:

Profile before optimizing — identify actual bottlenecks
Measure the impact of each change
Consider the trade-off between speed and readability
Cache expensive operations with appropriate invalidation
Use connection pooling for database and network resources

Monitoring and Observability

Production systems need visibility:

Structured logging with correlation IDs for request tracking
Metrics for latency, throughput, error rates, and resource usage
Health check endpoints for load balancers and orchestration
Distributed tracing for request flows across services
Alerts for anomaly detection based on baselines

These patterns apply across all programming languages and frameworks. The specific implementation varies, but the principles remain consistent.

FAQ

Q: What is the difference between ip and ifconfig? A: ip (from iproute2) is modern, actively maintained, and supports advanced features. ifconfig (net-tools) is legacy and deprecated on many distributions.

Q: How do I find which process is using a port? A: Use ss -tlnp | grep :PORT or lsof -i :PORT. The -p flag in ss shows process information.

Q: How do I check if a remote port is open? A: Use nc -zv HOST PORT, telnet HOST PORT, or timeout 5 bash -c 'echo > /dev/tcp/HOST/PORT'.

Q: How do I permanently configure a static IP? A: Edit configuration in /etc/network/interfaces (Debian) or create a Netplan config at /etc/netplan/ (Ubuntu 18+), or use NetworkManager configuration.

Q: What is the fastest way to test DNS resolution? A: Use dig +short example.com — it bypasses system configuration quirks.

Q: How do I capture traffic on a remote server? A: Use ssh user@remote "tcpdump -w - -i eth0 port 80" | wireshark -k -i - to pipe captured traffic directly to Wireshark over SSH.

Practical Networking Commands

Network Diagnostics

# Trace the route packets take
traceroute -n example.com

# DNS lookup with detailed output
dig +short example.com
dig example.com ANY

# Query DNS with specific server
dig @8.8.8.8 example.com

# Check if a port is open
nc -zv example.com 443

# Scan ports on a remote host
nmap -sT -p 80,443,22 example.com

# Monitor real-time bandwidth usage
iftop -n
nethogs

Network Configuration

# Show all interfaces and IPs
ip addr show

# Show routing table
ip route show

# Add a static route
sudo ip route add 10.0.0.0/8 via 192.168.1.1 dev eth0

# Check ARP cache
ip neigh show

# Capture packets with tcpdump
sudo tcpdump -i eth0 -nn port 80
sudo tcpdump -i eth0 -w /tmp/capture.pcap

Firewall Management (UFW)

# Basic UFW configuration
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

TCP Tuning

# View current TCP settings
sysctl net.ipv4.tcp_congestion_control
sysctl net.core.rmem_max

# Tune TCP for throughput (add to /etc/sysctl.conf)
echo "net.core.rmem_max = 16777216" >> /etc/sysctl.conf
echo "net.core.wmem_max = 16777216" >> /etc/sysctl.conf
echo "net.ipv4.tcp_rmem = 4096 87380 16777216" >> /etc/sysctl.conf
echo "net.ipv4.tcp_wmem = 4096 65536 16777216" >> /etc/sysctl.conf
sysctl -p