Learn › Linux Foundations › Networking and Remote Access
Part 1 of 2: ip address, ip link, ip route, getent, /etc/resolv.conf, ss and curl (Sections 22.1 to 22.6). No machine test here; it completes on the final step. The chapter lab waits at the end of Part 2.
This chapter covers the following topics:
This is Part 1 of 2. It covers Sections 22.1 to 22.6: how this server is connected to a network, read with ip, getent, ss and curl. Part 2 covers Sections 22.7 to 22.13: SSH, the way an administrator works on another machine, and copying files with scp. Part 2 ends in the chapter lab, which covers all thirteen sections.
What you already know: Section 1.5 printed this machine's addresses with hostname -I, and Section 4.6 read the names and addresses in /etc/hosts. Section 4.14 found the two network interfaces under /sys/class/net, eth0 and lo. This part reads the same facts with the tools an administrator uses on a network, and adds routes, name lookups, the programs that wait for connections, and a request to a web service.
Objectives
After this part you can:
Start the shared practice machine from the panel before using these terminals. They run your commands on a real Debian server as admin@server1, so file-writing commands change that practice machine. A step receives practice credit only when its requested command finishes with the expected result. Every command in this part only reads, except two that write files under ~/remote. Addresses, hardware addresses and some numbers differ on your machine, and each step says which. This part has no graded lab of its own; it completes on its final step. The graded lab for the whole chapter comes at the end of Part 2. It runs on a real Debian 12 server, free, and grades you from the files you produce and the commands you run.
Five questions before the material. A wrong answer costs nothing: the explanation states the fact and names the section that teaches it.
>>> 127.0.0.1 is the loopback address. It belongs to lo, the interface that connects the machine to itself, and a connection to it never leaves the machine. Section 22.1.
>>> ip route get asks the kernel's routing table which way a packet for that address would go. It sends nothing, so it says nothing about whether the other machine exists or answers. Section 22.3.
>>> On this server the name service switch reads the files in /etc first, and asks the name servers in /etc/resolv.conf only for names the files do not hold. backup1 is in /etc/hosts. Section 22.4.
>>> LISTEN means a program opened the socket and waits for clients. Bound to 127.0.0.1, it accepts connections from this machine only. Section 22.5.
>>> The message means the connection itself failed. Whether nothing listens there or a firewall refused the connection is a separate question, which ss and the machine's own rules answer. Section 22.6.
A network interface is a connection of the machine to a network (Section 4.14): eth0 is the network card and lo is the loopback, the connection of the machine to itself. Each interface carries one or more IP addresses (Section 4.6).
ip, from the iproute2 package, reads and changes all of this. The first word after it names an object, the kind of thing to show: address for addresses, link for interfaces, route for routes. An object may be shortened, so addr and a both mean address. With no further word, ip shows every entry of the object. The option -br, brief, prints one line per interface.
You are in your home directory. List every interface with its addresses in brief form:
prompt: admin@server1:~$ answer: ip -br addr ||| ip -br address ||| ip -br a ||| ip -brief addr ||| ip -brief address output: lo UNKNOWN 127.0.0.1/8 ::1/128 eth0 UP 172.236.114.197/24 2600:3c06::2000:18ff:fea5:81aa/64 fe80::2000:18ff:fea5:81aa/64 hint: Section 22.1. The tool ip, the brief option -br, then the object addr.
Three columns: the interface, its state, and its addresses. UP means the interface is working and has a link. UNKNOWN is what lo always reports, because a loopback has no cable to report on; it works.
Each address is followed by a slash and a prefix length: how many leading bits of the address name the network. /24 means the first three of the four numbers name the network and the last one names this machine in it. It is not a port. lo carries 127.0.0.1/8 and ::1/128, the same on every Linux machine.
eth0 carries this server's IPv4 address and its IPv6 addresses. The one that starts with fe80: is a link-local address, which every IPv6 interface gives itself and which works only on the directly attached network. Your eth0 addresses differ from the ones shown: every machine gets its own. The eth0 line is longer than a narrow window and wraps. hostname -I in Section 1.5 printed the same addresses, without lo and without the link-local one.
Without -br, ip prints every detail, and the word show followed by an interface name limits the output to that interface. lo is the same on every Linux machine, which makes it the one to read line by line. You are in your home directory. Show the full address details of lo:
prompt: admin@server1:~$ answer: ip addr show lo ||| ip address show lo ||| ip a show lo ||| ip a s lo ||| ip addr show dev lo output: 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host noprefixroute valid_lft forever preferred_lft forever hint: Section 22.1. The tool ip, the object addr, the word show, then the interface name lo.
Line 1: the interface number, 1, the name, then the flags in angle brackets: LOOPBACK, UP (switched on) and LOWER_UP (the link beneath it works). mtu 65536 is the largest packet the interface carries, in bytes. state UNKNOWN is the state column of the brief form, and qlen 1000 is the length of its queue of packets waiting to be sent.
Line 2: the kind of link and its hardware address, all zeros, because lo has no hardware (Section 4.14).
Line 3: inet introduces the IPv4 address. scope host means the address is valid inside this machine only, and the last word is the address's label, lo. Line 5: inet6 introduces the IPv6 address, also scope host; noprefixroute says the kernel adds no route for its network.
Lines 4 and 6: the lifetime of each address. An address the network lends for a limited time counts down here; these two never expire.
ip link shows the interfaces themselves, beneath the addresses. An interface exists and has a state even when it carries no address at all. The hardware address, also called the MAC address, is the address of the interface on its local network, the one Section 4.14 read from /sys/class/net/eth0/address. You are in your home directory. List every interface in brief form:
prompt: admin@server1:~$ answer: ip -br link ||| ip -brief link ||| ip -br l ||| ip -br link show output: lo UNKNOWN 00:00:00:00:00:00 <LOOPBACK,UP,LOWER_UP> eth0 UP 22:00:18:a5:81:aa <BROADCAST,MULTICAST,UP,LOWER_UP> hint: Section 22.2. The tool ip, the brief option -br, then the object link.
The name and the state, then the hardware address, then the flags. eth0 can reach every machine on its network at once, BROADCAST and MULTICAST, and it is switched on with a working link, UP,LOWER_UP. Your hardware address differs: each virtual interface gets its own when the machine is created. An interface in the state DOWN carries nothing, whatever addresses it holds.
A route tells the kernel where to send a packet for a destination, and the list of routes is the routing table. Each line names a destination network, then the way to it: dev names the interface, and via names a gateway, a machine on the local network that passes packets on toward other networks. The line whose destination is default is the default route, the one used for every address no other line matches. You are in your home directory. Print the routing table:
prompt: admin@server1:~$ answer: ip route ||| ip route show ||| ip r ||| ip route list ||| ip r s output: default via 172.236.114.1 dev eth0 onlink 172.236.114.0/24 dev eth0 proto kernel scope link src 172.236.114.197 hint: Section 22.3. The tool ip, then the object route, with nothing after it.
Two lines. The first is the default route: a packet for any address the table has no better line for goes to the gateway on eth0. onlink says the gateway is reached directly on that interface. The second line is the local network, the /24 that eth0's address belongs to. proto kernel means the kernel added the line itself when the address was set, scope link means these destinations are on the directly attached network, and src is the address this machine sends from.
Your addresses and your gateway differ; the shape is the same. ip route shows the IPv4 table, and ip -6 route shows the IPv6 one.
ip route get takes one destination and prints the route the kernel would choose for it. It sends no packet: the answer comes from the routing table alone. You are in your home directory. Ask how the kernel reaches the loopback address:
prompt: admin@server1:~$ answer: ip route get 127.0.0.1 ||| ip r get 127.0.0.1 ||| ip r g 127.0.0.1 output: local 127.0.0.1 dev lo src 127.0.0.1 uid 1000 cache <local> hint: Section 22.3. ip route, the word get, then the address 127.0.0.1.
local means the destination is this machine. The packet would go through lo, with 127.0.0.1 as its sender. uid 1000 is the user ID that asked, admin (Section 7.2). The second line marks the answer as a local delivery, taken from a table the kernel keeps for its own addresses, which ip route did not print.
Section 4.6 found backup1 at 10.0.0.5 in /etc/hosts. No line of the routing table names that network, so the default route applies. You are in your home directory. Ask how the kernel reaches 10.0.0.5:
prompt: admin@server1:~$ answer: ip route get 10.0.0.5 ||| ip r get 10.0.0.5 ||| ip r g 10.0.0.5 output: 10.0.0.5 via 172.236.114.1 dev eth0 src 172.236.114.197 uid 1000 cache hint: Section 22.3. ip route get, then the address of backup1, 10.0.0.5.
The gateway after via, the interface eth0, and the sending address: the default route of Exercise 22-4, applied to one address. Nothing left the machine. Whether backup1 exists and answers is a different question, and Section 22.6 shows what happens when this server tries. Your addresses differ from the ones shown.
Programs use names; networks use addresses. The name service switch is the part of the system library that turns one into the other. Its order is set in /etc/nsswitch.conf, and on this server it reads the files in /etc first, then asks the name servers listed in /etc/resolv.conf. getent asks the switch the same question a program asks, so its answer is the one ssh, curl or any other program gets. getent hosts NAME prints the address for a name. You are in your home directory. Look up backup1:
prompt: admin@server1:~$ answer: getent hosts backup1 output: 10.0.0.5 backup1 hint: Section 22.4. The lookup tool getent, the database hosts, then the name backup1.
The address, 10.0.0.5, then the name. It came from /etc/hosts (Section 4.6): the files come first and they held the name, so no name server was asked. Every program on this server that is given the name backup1 uses 10.0.0.5.
/etc/hosts gives localhost two addresses: 127.0.0.1 for IPv4 and ::1 for IPv6. You are in your home directory. Look up localhost:
prompt: admin@server1:~$ answer: getent hosts localhost output: ::1 localhost ip6-localhost ip6-loopback hint: Section 22.4. The same lookup as Exercise 22-7, with the name localhost.
One line: ::1, then localhost and the two other names on the same line of /etc/hosts. When a name has both kinds of address, getent hosts prints the IPv6 one; getent ahosts NAME lists every address a program may be given. Both addresses reach this machine through lo.
An administrator writes down what a check found, so the record outlasts the terminal. echo prints a word (Section 1.7), and > sends that output into a file (Section 11.2). The directory ~/remote/answers exists for this chapter's answers. You are in your home directory. Write the address of backup1 into ~/remote/answers/backup1.txt:
prompt: admin@server1:~$ answer: echo 10.0.0.5 > ~/remote/answers/backup1.txt ||| echo 10.0.0.5 > /home/admin/remote/answers/backup1.txt output: hint: Section 22.4. echo, the address 10.0.0.5, then > and the path ~/remote/answers/backup1.txt.
Nothing printed: > sent echo's line into the file. The chapter lab asks for one answer written this way.
You are in your home directory. Print the file back:
prompt: admin@server1:~$ answer: cat ~/remote/answers/backup1.txt ||| cat /home/admin/remote/answers/backup1.txt output: 10.0.0.5 hint: Section 22.4. The printing tool from Section 4.3, then the path ~/remote/answers/backup1.txt.
The address and nothing else: the one line echo wrote.
A name that /etc/hosts does not hold goes to a name server (Section 4.6). /etc/resolv.conf lists the name servers this machine asks, one nameserver line each. You are in your home directory. Print it:
prompt: admin@server1:~$ answer: cat /etc/resolv.conf output:
... domain members.linode.com search members.linode.com nameserver 172.232.0.21 nameserver 172.232.0.16 nameserver 172.232.0.17 options rotate hint: Section 22.4. The printing tool, then the absolute path /etc/resolv.conf.
The first line names the program that wrote the file: Linode's Network Helper writes it at every boot, with the date and a link to this machine's settings, in comment lines trimmed here as .... Your comment lines, your date and your name servers differ.
domain and search name the domain tried after a short name, so a lookup of backup2 also tries backup2.members.linode.com. Each nameserver line is one name server, and options rotate spreads the questions across them.
Once this lab machine has booted, it refuses every connection that would leave it (Section 22.6), so a name that is not in /etc/hosts gets no answer here.
A port is a number from 1 to 65535 that names one service on a machine, so one address can offer many services. A socket is one end of a network connection inside a program: an address with a port. A program that offers a service opens a listening socket and waits; each client that connects gets a connection of its own. TCP, the Transmission Control Protocol, is the kind of connection SSH and the web use.
ss, socket statistics, lists sockets. -t selects TCP, -l selects listening sockets, and -n prints numbers instead of looking up names for addresses and ports. You are in your home directory. List the listening TCP sockets:
prompt: admin@server1:~$ answer: ss -tln ||| ss -ltn ||| ss -lnt ||| ss -ntl ||| ss -nlt ||| ss -tnl ||| ss -t -l -n output: State Recv-Q Send-Q Local Address:Port Peer Address:Port Process LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 0 5 127.0.0.1:8080 0.0.0.0:* LISTEN 0 128 [::]:22 [::]:* hint: Section 22.5. The tool ss with three options together: -t for TCP, -l for listening, -n for numbers.
Each row is one listening socket, and Local Address:Port is where it listens. 0.0.0.0:22 is sshd, the SSH server, on port 22 of every IPv4 address this machine has; 0.0.0.0 stands for all of them. [::]:22 is the same server on every IPv6 address, the brackets keeping the address apart from the port. 127.0.0.1:8080 is a web service that listens on the loopback address only, so only programs on this machine reach it.
Peer Address:Port reads *: a listener has no other end until a client connects. For a l
Practice Chapter 22, Part 1. Networking and Remote Access: ip, getent, ss and curl in a real Linux terminal at The Linux Camp. Progress is verified automatically as you type commands on the machine.