Lesson 13 · Networking, scripting and internals

Network tools on Linux

On Linux the kernel runs the network: it keeps the interfaces, their addresses and the routing table, and it sends every packet. Network tools are small programs that ask it. Follow four read-only commands up from this machine to the internet: ip -br -4 addr, ip route show default, ping -c 1 to the gateway and curl -sI to a web server, and learn to debug a broken connection from the bottom up.

12 min9 steps5 questionsAdvanced

Fig 13 · Interactive

Loading figure…

or ← →

Check yourself

5 quick questions

Pick an answer to see why. Your score saves with your progress.

01Where does Linux keep the list of interfaces, their addresses and the routing table?

The kernel holds the network state and sends every packet. ip only asks it, over a netlink socket, and prints the answer.

02ip -br -4 addr shows eth0 with 192.168.1.20/24. Which address is on the same local network?

/24 means the first 24 bits (192.168.1) are the network part, so every 192.168.1.x address is a neighbour, reached directly. 127.0.0.1 is the loopback: this machine itself.

03ip route show default prints: default via 192.168.1.1 dev eth0. What does it mean?

The default route is the exit for every address that is not local. via names the gateway (your router), dev the interface the packet leaves through.

04ping prints: 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.9 ms. What does time=0.9 ms measure?

ping times each echo request until its echo reply comes back. ttl is the reply's hop counter (its start value was set by the gateway), and 64 bytes is 56 bytes of data plus 8 bytes of ICMP header.

05ping to your gateway works, but curl -sI https://example.com fails. Where should you look next?

A working ping to the gateway proves the address, the route to it, the card and the cable. What is left is beyond it: DNS, the internet path, or the server itself.

Key terms

Glossary

Interface: One network connection of a machine, such as eth0 (a cable) or wlan0 (Wi-Fi). lo, the loopback, is the machine talking to itself.
Netlink: A kind of socket that programs such as ip use to read and change the kernel's interfaces, addresses and routes.
Prefix length (/24): How many leading bits of an address name the network. In 192.168.1.20/24 the network is 192.168.1 and the host is .20.
Routing table: The kernel's list of rules saying where each packet should go and through which interface.
Default route / gateway: The route used when no other matches: hand the packet to the gateway, usually your router, which leads to the internet.
ICMP echo: A tiny test message (echo request) that a host answers with an echo reply. ping sends it and times the reply.
TTL: Time to live: a hop counter in every IP packet. Each router lowers it by one and drops the packet at zero. Packets Linux sends start at 64; Windows starts at 128.
HTTP status 200: The web server's answer meaning OK: the page you asked for is there.

Fine print

Notes and sources

The machine in the example has the address 192.168.1.20/24 on eth0 and its router at 192.168.1.1, a typical home network. Interface names differ (eth0, enp3s0, wlan0), and the ping time is an example.
The card trims the output to fit: ip pads its columns wider, ping also prints a header line and a summary, ping's long reply line is wrapped, and curl prints more header lines after HTTP/2 200.
Every command in this lesson only reads or tests; none changes the network. Commands that change it, such as ip addr add or ip route del, need root (sudo) and can cut you off from a remote machine, so try them only on a test system.
Older guides use ifconfig, route and netstat (the net-tools package). Current distributions ship ip and ss (iproute2) instead, and many no longer install net-tools.
curl's name lookup (DNS) also uses the network: usually a query to a resolver on your network or on this machine. The figure leaves it out to keep one path in view.

Quiz Unlocks after the last step.