Basic Networking Commands

Basic Networking Commands

Linux provides a collection of command-line tools that allow administrators
and cybersecurity professionals to inspect network interfaces, IP addresses,
routes, DNS configuration, connections and network behavior.

These commands are valuable because networking problems and security events
often leave observable information at the network layer.

However, network commands should always be used responsibly. Perform
diagnostics, testing and scanning only on systems and networks that you own
or have explicit authorization to assess.

1. Why Networking Commands Matter

A Linux administrator may need to answer questions such as:

• Does this system have an IP address?
• Which network interfaces are available?
• Which gateway is being used?
• Which DNS servers are configured?
• Can the system reach another authorized host?
• Which services are listening for network connections?
• Is DNS resolution working?
• Where might a routing problem be occurring?

Linux networking commands provide evidence that can help answer these
questions.

2. The ip Command

The modern Linux ip command is one of the most important tools
for inspecting and managing network configuration.

It can display interfaces, addresses, routes and neighboring devices.

3. Viewing IP Addresses with ip addr

Use:

ip addr

or:

ip address

The output can show:

• Network interfaces.
• Interface state.
• MAC addresses.
• IPv4 addresses.
• IPv6 addresses.
• Prefix lengths.

For example, an interface may have an address similar to:

192.168.1.20/24

The /24 is CIDR notation describing the network prefix.

4. Viewing Network Interfaces with ip link

Use:

ip link

This focuses on network interfaces and their link-layer information.

An interface may have states such as:

• UP
• DOWN

The exact output depends on the Linux system and its network hardware.

5. Understanding Network Interfaces

A network interface provides a connection between the operating system and a
network.

Examples can include:

• Ethernet interfaces.
• Wireless interfaces.
• Virtual network interfaces.
• Loopback interfaces.
• Container or virtualization interfaces.

The loopback interface is commonly represented as lo.

6. The Loopback Address

The IPv4 loopback address is commonly:

127.0.0.1

It refers back to the local machine.

Testing the loopback interface can help determine whether basic local TCP/IP
functionality is working.

7. Testing Connectivity with ping

The ping command is commonly used to test network reachability
using ICMP.

For example:

ping 127.0.0.1

This is a safe local test because it targets the local host.

In an authorized network environment, an administrator might also test a
known internal gateway:

ping 192.168.1.1

Only use addresses that you are authorized to test.

8. What ping Can and Cannot Tell You

A successful ping can provide evidence that a host or network path is
responding to ICMP.

However, a failed ping does not necessarily mean that the host is offline.
A firewall may block ICMP while allowing normal application traffic.

Similarly, a successful ping does not prove that a specific web, database or
SSH service is functioning.

9. Viewing the Routing Table

Use:

ip route

The routing table helps Linux determine where packets should be sent.

A typical configuration may contain a default route similar to:

default via 192.168.1.1 dev eth0

This concept means that traffic without a more specific route can be sent
through the specified gateway and interface.

10. Default Gateway

A default gateway is normally the router used to reach networks outside the
local subnet.

If a Linux computer can communicate with local devices but cannot reach
external networks, checking the routing table and gateway is a useful
troubleshooting step.

11. Network Neighbors with ip neigh

The command:

ip neigh

can display information about neighboring systems known through the local
network’s neighbor-discovery mechanisms.

On IPv4 networks, this is closely related to ARP.

Neighbor information can help an administrator understand local network
communication.

12. What Is ARP?

ARP, or Address Resolution Protocol, is used in IPv4 networks to associate an
IP address with a MAC address on the local network.

For example, a computer may know that a gateway has an IP address but needs
the gateway’s MAC address to send an Ethernet frame on the local network.

13. Viewing Network Connections with ss

The ss command is commonly used to inspect sockets and network
connections.

For example:

ss

A more detailed view can be obtained with options appropriate to the local
system, such as:

ss -tuln

This is commonly used to display TCP and UDP listening sockets using numeric
addresses and ports.

14. Why ss Matters in Cybersecurity

Listening network services can reveal which applications are exposed through
the network.

For example, an administrator may discover that an application is listening
on a port that was not expected to be exposed.

This does not automatically indicate an attack. The administrator should
compare the result with the documented system configuration.

15. DNS Troubleshooting

DNS translates human-readable domain names into information such as IP
addresses.

When DNS fails, users may report that websites or services cannot be reached
even though general network connectivity is available.

Linux systems commonly provide tools such as:

nslookup
dig
host

16. Using nslookup

A basic DNS lookup can be performed with:

nslookup example.com

Use a known legitimate domain for classroom exercises and follow your
organization’s network-testing rules.

The result may provide information about the DNS server used and the response
received.

17. Using dig

The dig utility provides detailed DNS query information.

For example:

dig example.com

It can be particularly useful for administrators and security analysts
because it exposes more detail about the DNS response.

18. Reverse DNS

Forward DNS commonly maps a domain name to an IP address.

Reverse DNS performs the opposite type of lookup by resolving an IP address
to a domain name when a corresponding reverse record exists.

The two systems are related but are not guaranteed to provide matching
results.

19. Traceroute

The traceroute command can help show the network path between a
source system and a destination.

For example, in an authorized environment:

traceroute example.com

Some Linux systems may use different tools or require additional packages.

Traceroute can help identify where traffic appears to stop or experience
unexpected delays.

20. Interpreting Traceroute Carefully

A missing response from one hop does not automatically mean that the router
at that hop is broken.

Network devices may intentionally ignore or rate-limit diagnostic traffic.
Later hops may still respond normally.

Therefore, traceroute output should be interpreted as diagnostic evidence,
not as absolute proof of a network failure.

21. curl for Web Connectivity

The curl command is widely used for testing HTTP and HTTPS
connectivity.

For example:

curl -I https://example.com

The -I option requests response headers rather than downloading
the full response body.

This can help an administrator determine whether an HTTP(S) service is
reachable and how the server responds.

22. HTTPS and curl

When testing HTTPS, curl can also provide useful information about TLS
connections.

Do not disable certificate verification simply to make an unfamiliar server
appear to work. Certificate validation is an important part of secure
communication.

23. wget

The wget utility is another command-line networking tool often
used for retrieving files or web resources.

Because downloading files can introduce security risks, students should use
trusted resources and authorized laboratory systems.

24. A Structured Troubleshooting Process

Network troubleshooting is more effective when performed systematically.

A useful sequence is:

1. Check the physical or virtual network interface.
2. Check the interface state.
3. Check the IP address.
4. Check the subnet configuration.
5. Check the default gateway.
6. Check local connectivity.
7. Check DNS resolution.
8. Check routing.
9. Check the destination port or service.
10. Check firewall and security controls.
11. Document the findings.

25. Example Troubleshooting Flow

Suppose a Linux workstation cannot access a website.

The administrator should avoid immediately assuming that the website is
offline.

A structured investigation could begin with:

ip addr
ip route
ping 127.0.0.1
ping <authorized-gateway>
nslookup example.com
curl -I https://example.com

Each test answers a different question.

26. Diagnosing an IP Configuration Problem

If ip addr shows that the expected interface has no valid address,
the problem may involve DHCP, static configuration or the network interface
itself.

The administrator should then investigate the appropriate network-management
configuration for that Linux distribution.

27. Diagnosing a Routing Problem

If the system has an IP address but cannot reach networks outside the local
subnet, inspect:

ip route

A missing or incorrect default route can prevent traffic from reaching
external networks.

28. Diagnosing a DNS Problem

If an IP address is reachable but a domain name cannot be resolved, DNS may
be the problem.

Compare:

ping 1.1.1.1
nslookup example.com

This is only a conceptual troubleshooting example. The chosen test address
should be appropriate for your authorized environment.

29. Diagnosing a Service or Port Problem

A system may have working network connectivity while a particular service is
unavailable.

An administrator can inspect local listening sockets with:

ss -tuln

For a service that you are authorized to test, controlled connectivity testing
can then be performed.

30. Network Commands and Cybersecurity

Network commands can provide important evidence during cybersecurity
investigations.

Analysts may examine:

• Unexpected network interfaces.
• Unexpected IP addresses.
• Unusual routes.
• Unexpected listening services.
• Unexpected DNS configuration.
• Suspicious network connections.

However, a single observation should not automatically be treated as proof
of malicious activity.

31. Basic Security Investigation Scenario

Imagine that a Linux server is reported to be communicating with an unknown
network destination.

An authorized analyst could begin by identifying the local network
configuration:

ip addr
ip route
ss -tunap

The analyst can then correlate the findings with:

• Process information.
• Application logs.
• Firewall logs.
• DNS records.
• User activity.
• Known system configuration.

The objective is to establish what happened using evidence rather than
assuming that every unfamiliar connection is malicious.

32. Safe Networking Laboratory

Perform this laboratory only on your own Linux virtual machine, training
network or another environment where you have explicit permission to test.

1. Run ip addr.
2. Identify the loopback interface.
3. Identify the active network interface.
4. Record the system’s private IP address.
5. Run ip route.
6. Identify the default route if one exists.
7. Run ip neigh.
8. Run ss -tuln.
9. Use nslookup or dig for an approved domain.
10. Use curl -I against an approved HTTPS website.
11. Document your observations.

33. PHP Example — Synthetic Network Validation

The following example validates network configuration values supplied to the
program. It does not scan a network or establish remote connections.

<?php

$network = array(
    'ip_address' => '192.168.1.20',
    'gateway'    => '192.168.1.1',
    'dns_server' => '192.168.1.1',
    'interface'  => 'eth0',
);

$checks = array();

if ( ! filter_var( $network['ip_address'], FILTER_VALIDATE_IP ) ) {
    $checks[] = 'Invalid IP address.';
}

if ( ! filter_var( $network['gateway'], FILTER_VALIDATE_IP ) ) {
    $checks[] = 'Invalid gateway address.';
}

if ( ! filter_var( $network['dns_server'], FILTER_VALIDATE_IP ) ) {
    $checks[] = 'Invalid DNS server address.';
}

if ( empty( $checks ) ) {

    echo 'Synthetic network configuration passed validation.';

} else {

    echo implode(
        '<br>',
        array_map( 'esc_html', $checks )
    );
}

34. Important Safety Principle

Networking tools can be used for legitimate administration, troubleshooting
and security analysis, but they can also be misused for unauthorized
reconnaissance.

Dwallnet students should therefore follow this rule:

Only inspect, test or scan systems and networks that you own or
have explicit authorization to assess.

35. Practical Assignment

In your authorized Linux laboratory, prepare a short report containing:

1. Your active network interface.
2. Your local IP address.
3. Your default gateway.
4. The purpose of ip addr.
5. The purpose of ip route.
6. The purpose of ping.
7. The purpose of ss.
8. The difference between forward and reverse DNS.
9. One reason why traceroute results must be interpreted carefully.
10. Three ways networking information can assist a cybersecurity investigation.

36. Review Questions

1. What does ip addr display?
2. What is the purpose of ip link?
3. What is a default gateway?
4. What information does ip route provide?
5. What does ping test?
6. Why does a failed ping not necessarily mean that a server is offline?
7. What is the purpose of ss?
8. What is ARP?
9. What is the purpose of ip neigh?
10. What are nslookup and dig used for?
11. What is traceroute useful for?
12. What is curl commonly used for?
13. Why should network-testing tools only be used on authorized systems?

37. Key Takeaways

• ip addr is useful for inspecting IP addresses and interfaces.
• ip link provides interface information.
• ip route helps administrators understand routing decisions.
• ping can test basic connectivity but has limitations.
• ss helps inspect network sockets and connections.
• ip neigh provides local neighbor information.
• nslookup and dig help troubleshoot DNS.
• traceroute can help investigate network paths.
• curl can help test HTTP and HTTPS services.
• Network troubleshooting should follow a structured process.
• Network observations should be correlated with other evidence during security investigations.
• Authorization is essential when performing network diagnostics or security testing.

Conclusion

Basic networking commands give Linux administrators and cybersecurity
professionals direct visibility into the network configuration of a system.
By understanding interfaces, addresses, routes, DNS, sockets and connectivity,
students can troubleshoot problems and gather useful defensive security
evidence.

The next lesson will cover Package Management, including
Linux repositories, packages, dependencies, security updates and safe
software installation practices.