Networking Fundamentals

# ip is already installed — part of iproute2
which ip

# ifconfig requires net-tools (not recommended for new setups)
sudo apt install net-tools -y

# Show all interfaces and their IP addresses
ip addr
ip addr show

# Show a specific interface
ip addr show eth0
ip addr show enp3s0

# Show only IPv4 addresses
ip -4 addr

# Show only IPv6 addresses
ip -6 addr

# Add an IP address to an interface (temporary — lost on reboot)
sudo ip addr add 192.168.1.50/24 dev eth0

# Remove an IP address
sudo ip addr del 192.168.1.50/24 dev eth0

# Show all interfaces with link-layer info (MAC, MTU, state)
ip link show
ip link

# Show a specific interface
ip link show eth0

# Bring an interface up or down
sudo ip link set eth0 up
sudo ip link set eth0 down

# Change MTU (useful for jumbo frames on 10GbE)
sudo ip link set eth0 mtu 9000

# Show interface statistics (bytes/packets TX and RX)
ip -s link show eth0

# Show the routing table
ip route
ip route show

# Show which interface and gateway would be used to reach a host
ip route get 8.8.8.8
ip route get 192.168.1.1

# Add a static route (temporary)
sudo ip route add 10.0.0.0/8 via 192.168.1.1

# Delete a route
sudo ip route del 10.0.0.0/8

# Show the default gateway
ip route | grep default

# Show ARP table (IP → MAC mappings on local network)
ip neigh
ip neigh show

# Flush ARP cache for an interface
sudo ip neigh flush dev eth0

# dig is in the dnsutils / bind9-dnsutils package
sudo apt install dnsutils -y

# Look up A record (IPv4 address) for a domain
dig anfamily.cloud

# Short answer only — just the IP
dig anfamily.cloud +short

# Look up specific record types
dig anfamily.cloud A        # IPv4
dig anfamily.cloud AAAA     # IPv6
dig anfamily.cloud MX       # Mail servers
dig anfamily.cloud NS       # Nameservers
dig anfamily.cloud TXT      # SPF, DKIM, verification records
dig anfamily.cloud CNAME    # Alias records
dig anfamily.cloud SOA      # Start of Authority

# Reverse lookup — IP to hostname
dig -x 8.8.8.8 +short

# Query Cloudflare's public resolver directly
dig @1.1.1.1 anfamily.cloud

# Query Google's public resolver
dig @8.8.8.8 anfamily.cloud

# Query your own server's resolver
dig @localhost anfamily.cloud

# Useful for diagnosing propagation — compare results from different resolvers
dig @1.1.1.1 anfamily.cloud +short
dig @8.8.8.8 anfamily.cloud +short

# Trace from root nameservers down — shows every delegation step
dig anfamily.cloud +trace

# Check TTL — how long the record is cached
dig anfamily.cloud | grep "ANSWER SECTION" -A 3

# The number before the record type is the TTL in seconds
# Example: anfamily.cloud. 300 IN A 104.21.45.78
# This record expires from cache in 300 seconds (5 minutes)

# host — simple, clean output
host anfamily.cloud
host -t MX anfamily.cloud

# nslookup — interactive or one-shot
nslookup anfamily.cloud
nslookup anfamily.cloud 1.1.1.1

# resolvectl — check systemd-resolved status and cache
resolvectl status
resolvectl query anfamily.cloud

# On Ubuntu 24.04 with systemd-resolved
cat /etc/resolv.conf
resolvectl status | grep "DNS Servers"

# Show which DNS server is actually being used
systemd-resolve --status | grep "DNS Servers" -A 3

# Show all listening TCP and UDP ports with process names
sudo ss -tlnp      # TCP listening, numeric, with process
sudo ss -ulnp      # UDP listening, numeric, with process
sudo ss -tlunp     # Both TCP and UDP listening

# Show all established TCP connections
ss -tn state established

# Show everything — all states, all protocols
sudo ss -anp

# Filter by port number
sudo ss -tlnp | grep :80
sudo ss -tlnp | grep :443
sudo ss -tlnp | grep :3306   # MySQL — should only show 127.0.0.1

# Show connection summary stats
ss -s

# Count established connections
ss -nt state established | wc -l

# Show connections by remote IP (useful for detecting floods)
ss -nt | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -10

# netstat requires net-tools — install if needed
sudo apt install net-tools -y

# Show listening ports (equivalent to ss -tlnp)
sudo netstat -tlnp

# Show all connections
sudo netstat -anp

# Show routing table
netstat -rn

# Web server
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# SSH on non-standard port (rate-limited)
sudo ufw limit 2222/tcp

# Allow MySQL only from a specific IP (e.g. another server)
sudo ufw allow from 192.168.1.50 to any port 3306

# Allow Samba from LAN only
sudo ufw allow from 192.168.1.0/24 to any port 445

# Deny a specific port explicitly (optional — default deny handles it)
sudo ufw deny 3306

# Show the current hostname
hostname
hostnamectl

# Show just the FQDN (fully qualified domain name)
hostname -f

# Show static, transient, and pretty hostnames
hostnamectl status

# Set a new hostname (persists across reboots)
sudo hostnamectl set-hostname myserver

# Verify
hostnamectl status

# Format: IP_ADDRESS   hostname   [alias ...]
# Lines starting with # are comments

127.0.0.1       localhost
127.0.1.1       myserver myserver.local

# IPv6 localhost
::1             localhost ip6-localhost ip6-loopback

# Custom entries — local lab machines
192.168.1.10    nas.local nas
192.168.1.20    pi.local pi
192.168.1.30    switch.local

# Edit the hosts file
sudo nano /etc/hosts

# Test a domain locally before DNS propagates
# Point domain to your server's LAN IP during development:
# 192.168.1.100   mysite.com www.mysite.com

# Block a domain by pointing it to localhost
# 127.0.0.1   ads.example.com

# Verify the hosts file is being read correctly
getent hosts myserver
getent hosts 192.168.1.10

# Flush DNS cache after hosts file changes (systemd-resolved)
sudo systemctl restart systemd-resolved
sudo resolvectl flush-caches

# NSS (Name Service Switch) controls resolution order
cat /etc/nsswitch.conf | grep hosts
# hosts: files mdns4_minimal [NOTFOUND=return] dns

# "files" = /etc/hosts first, then DNS
# Change order here if needed (rarely necessary)

# MySQL should ONLY show 127.0.0.1:3306 — not 0.0.0.0:3306
sudo ss -tlnp | grep 3306

# Nginx should show 0.0.0.0:80 and 0.0.0.0:443
sudo ss -tlnp | grep nginx

# SSH should show on your chosen port
sudo ss -tlnp | grep ssh

# Step 1: Can we reach the DNS server at all?
ping -c 3 1.1.1.1

# Step 2: Does DNS resolution work with a specific server?
dig @1.1.1.1 google.com +short

# Step 3: Does the system resolver work?
dig google.com +short

# Step 4: Check /etc/resolv.conf
cat /etc/resolv.conf

# Step 5: Check systemd-resolved status
systemctl status systemd-resolved
resolvectl status

# Who is listening on port 80?
sudo ss -tlnp | grep :80

# Alternative using lsof
sudo lsof -i :80
sudo lsof -i :443

# Find by PID
sudo lsof -p 1234

# Test TCP connectivity to a host:port (no install needed)
nc -vz anfamily.cloud 443
nc -vz anfamily.cloud 22

# Test with a timeout
nc -vz -w 3 anfamily.cloud 80

# Test using /dev/tcp (pure bash, no tools needed)
timeout 3 bash -c '</dev/tcp/anfamily.cloud/443' && echo "open" || echo "closed"

# Compact summary of all interfaces
ip -brief addr
ip -brief link

# Example output:
lo               UNKNOWN        127.0.0.1/8
eth0             UP             192.168.1.100/24
enp3s0           UP             10.0.0.5/24