1 of 3

Network ConfigurationLesson 1 of 3

Reading network state and testing connectivity

Find the addresses, route, name servers and open ports of a host, and test the network one layer at a time.

  • ip
  • ip addr
  • ip route
  • ip -6
  • ss
  • ping
  • nmcli device
  • nmcli connection
  • getent
  • tracepath

40 min5 exercises

After this lesson you can

  • Read ip addr, ip route and ss output, including IPv6 addresses.
  • Match devices to NetworkManager connections.
  • Test connectivity in order: link, address, gateway, name resolution, remote service.

The idea

When “the network does not work” the cause is almost always in one of five layers. Check them from the bottom, and stop at the first that fails.

#LayerQuestionCommand
1LinkIs the interface up and connected?ip -br link, nmcli device status
2AddressDoes it have an IP address?ip -br addr
3RouteCan it reach the gateway?ip route, ping GATEWAY
4NamesDo names resolve to addresses?getent hosts NAME, /etc/resolv.conf
5ServiceIs the remote port reachable?ss, nc -zv HOST PORT, curl

IPv4 and IPv6 addresses

An IPv4 address is four numbers (192.168.122.50) and a prefix length, written /24, which says how many leading bits identify the network: /24 is the netmask 255.255.255.0, so 192.168.122.0 to .255 is one network.

An IPv6 address is eight groups of hex digits (fd00:10::50; :: abbreviates a run of zero groups) with a prefix, usually /64. Every IPv6-enabled interface also has a link-local address starting fe80::, valid only on the local link. Ranges beginning fd or fc are private (ULA); 2000::/3 are global.

The default gateway is the router used for destinations outside your own network. ip route shows it as default via ADDRESS.

ip and ss

ip replaced ifconfig, route and arp, and ss replaced netstat:

TaskCommand
Addresses, briefip -br addr
IPv6 onlyip -6 addr
Link state and MACip -br link, ip link
Routing tableip route, ip -6 route
Which route for a destinationip route get ADDRESS
Listening sockets with processsudo ss -tulnp

ip changes made directly (ip addr add ...) are lost at reboot and are not what the exam wants. Persistent configuration goes through NetworkManager, in the next lesson.

NetworkManager vocabulary

NetworkManager is the service that configures networking on RHEL. Two words matter:

  • A device is the interface: eth0, ens3, enp1s0, lo.
  • A connection (also called a profile) is a saved bundle of settings: name, type, IP method, addresses, DNS, auto-connect. A device can have several connections, but one is active at a time.

You can have a connection without a device (not applied) and a device without a connection (unmanaged or unconfigured). nmcli device status shows the devices; nmcli connection show lists the connections.

Try it

ip -br addr
lo               UNKNOWN        127.0.0.1/8 ::1/128
eth0             UP             192.168.122.50/24 fd00:122::50/64 fe80::5054:ff:fe12:3456/64

Read: eth0 is UP, has IPv4 192.168.122.50/24, a private IPv6 fd00:122::50/64, and the automatic link-local fe80::....

ip route
ip route get 8.8.8.8
default via 192.168.122.1 dev eth0 proto static metric 100
192.168.122.0/24 dev eth0 proto kernel scope link src 192.168.122.50 metric 100
8.8.8.8 via 192.168.122.1 dev eth0 src 192.168.122.50 uid 1000
    cache

Traffic for 192.168.122.x goes straight out eth0; everything else matches default and is sent to the gateway 192.168.122.1.

Devices and connections

nmcli device status
nmcli connection show
DEVICE  TYPE      STATE                   CONNECTION
eth0    ethernet  connected               System eth0
lo      loopback  connected (externally)  lo
NAME         UUID                                  TYPE      DEVICE
System eth0  5fb06bd0-0bb0-7ffb-45f1-d6edd65f3e03  ethernet  eth0
nmcli connection show "System eth0" | grep -E '^(ipv4|ipv6)\.(method|addresses|gateway|dns)'
ipv4.method:                            manual
ipv4.addresses:                         192.168.122.50/24
ipv4.gateway:                           192.168.122.1
ipv4.dns:                               192.168.122.1
ipv6.method:                            auto
ipv6.addresses:                         --
ipv6.gateway:                           --
ipv6.dns:                               --

method: manual means static, auto means DHCP (IPv4) or router advertisements (IPv6). A -- is an empty value. Connection names with spaces need quotes; the name on your system may differ (Wired connection 1, System eth0, ens3).

What is listening

sudo ss -tulnp
Netid State  Recv-Q Send-Q Local Address:Port Peer Address:Port Process
udp   UNCONN 0      0          127.0.0.1:323       0.0.0.0:*     users:(("chronyd",pid=731,fd=5))
tcp   LISTEN 0      128          0.0.0.0:22        0.0.0.0:*     users:(("sshd",pid=842,fd=3))
tcp   LISTEN 0      128             [::]:22           [::]:*     users:(("sshd",pid=842,fd=4))

0.0.0.0 and [::] mean “all addresses”: reachable from the network (if the firewall allows). 127.0.0.1 means local only: chronyd’s control port is not exposed.

Climb the layers

ip -br link
ip -br addr
ping -c2 192.168.122.1
getent hosts example.com
nc -zv example.com 443
eth0   UP    52:54:00:12:34:56 <BROADCAST,MULTICAST,UP,LOWER_UP>
eth0   UP    192.168.122.50/24
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
2606:2800:21f:cb07:6820:80da:af6b:8b2c example.com
Connection to example.com (93.184.216.34) 443 port [tcp/https] succeeded!

If ping 192.168.122.1 works but ping example.com fails, the network is fine and name resolution is the problem. If ping 8.8.8.8 fails and the gateway answers, look at routing or the upstream.

Going further

ip -s link adds packet and error counters; errors or drops on an interface point at cabling or duplex problems. tracepath HOST shows the hops to a destination. ethtool eth0 reports link speed and negotiation. nmcli -f GENERAL,IP4,IP6 device show eth0 is a compact dump for a device, and nmcli -g extracts a single value for scripts. arp is replaced by ip neigh, which shows which neighbours the host knows by MAC address. Interface names such as ens3 or enp1s0 are predictable names derived from firmware or bus position, which is why they differ between systems.

Practice

0 of 5 done

Do these on your own system. They get harder. Check each result, then tick it off.

  1. Warm-up

    What are my addresses?

    Show the IPv4 and IPv6 addresses of every interface in brief form. Report your main IPv4 address with prefix length, whether an IPv6 global address exists, and the MAC address of the first Ethernet interface.

    Check your result

    ip -br addr lists interfaces with state and addresses. ip link shows link/ether ....

    Hint

    ip -br addr, ip -4 addr, ip -6 addr, ip -br link.

    Solution
    ip -br addr
ip -4 addr show
ip -6 addr show
ip -br link
  2. Practice

    Where does traffic go, and who answers names?

    Find the default gateway, the route for your local subnet, and the configured DNS servers. Explain which line of ip route is used for a destination outside your subnet.

    Check your result

    ip route shows default via GATEWAY dev IFACE and a connected subnet route. nmcli dev show or /etc/resolv.conf lists nameserver addresses.

    Hint

    ip route, ip route get 8.8.8.8 (which route would be used), cat /etc/resolv.conf.

    Solution
    ip route
ip route get 8.8.8.8
cat /etc/resolv.conf
nmcli -g IP4.DNS device show
  3. Practice

    Devices versus connections

    List NetworkManager's devices and its connections. Explain the difference, identify which connection is active on which device, and show every setting of that connection.

    Check your result

    nmcli device status shows devices with state and connection. nmcli connection show lists connection names, UUIDs and devices. nmcli connection show NAME prints ipv4.method, ipv4.addresses etc.

    Hint

    A device is the hardware (eth0); a connection is a saved set of settings that can be applied to a device.

    Solution
    nmcli device status
nmcli connection show
nmcli connection show --active
nmcli connection show "$(nmcli -g NAME connection show --active | head -1)" | head -30
  4. Practice

    What is listening?

    List all TCP and UDP sockets that are listening, with the owning process, and answer: which ports are open to the whole network and which only to the local host?

    Check your result

    sudo ss -tulnp shows 0.0.0.0:22 or [::]:22 for sshd (all interfaces) and 127.0.0.1:... for local-only services.

    Hint

    ss -tulnp: t TCP, u UDP, l listening, n numeric, p process. Addresses 127.0.0.1 or [::1] are local only.

    Solution
    sudo ss -tulnp
sudo ss -tlnp 'sport = :22'
  5. Challenge

    Test the network from the bottom up

    Without guessing, run five checks in order and say what each proves: the interface is up, it has an address, the gateway answers, a name resolves, a remote port is reachable. Use ip, ping and getent hosts, and curl or ss/nc for the last step.

    Check your result

    Each check passes or fails independently. A failure at step N means steps below N are fine and above N are not worth testing yet.

    Hint

    ip -br link, ip -br addr, ping -c2 GATEWAY, getent hosts example.com, curl -sI http://host or nc -zv host 22.

    Solution
    ip -br link
ip -br addr
gw=$(ip route | awk '/^default/ {print $3; exit}')
ping -c2 "$gw"
getent hosts example.com
nc -zv example.com 443