Lesson 10: Networking Basics
Lesson 10: Networking Basics
Network Interfaces
ip a # Show all interfaces (modern)
ifconfig # Legacy (net-tools package)
ip link show # Just link layer info
ip addr show eth0 # Specific interface
Key Interface Types
- lo (loopback): 127.0.0.1, ::1 — localhost only
- eth0/ens33/enp0s3: Physical/virtual Ethernet
- docker0: Docker bridge
- tun0/wg0: VPN tunnels
IP Addresses & Routing
ip a # All IPs
ip -4 a # IPv4 only
ip -6 a # IPv6 only
ip route # Routing table
ip route get 8.8.8.8 # Route to specific IP
CIDR Notation
10.0.0.5/24= IP 10.0.0.5, netmask 255.255.255.0 (256 addresses)192.168.1.0/24= 192.168.1.0 - 192.168.1.255/32= single IP,/0= entire internet
Ports & Listening Services
ss -tulpn # Listening TCP/UDP with PID (modern)
netstat -tulpn # Legacy
ss -tuln # Without process names
ss -tan # All TCP connections
ss -uan # All UDP connections
lsof -i :80 # Process using port 80
Common Ports
| Port | Service | Protocol |
|---|---|---|
| 22 | SSH | TCP |
| 53 | DNS | UDP/TCP |
| 80 | HTTP | TCP |
| 443 | HTTPS | TCP |
| 3306 | MySQL | TCP |
| 5432 | PostgreSQL | TCP |
| 6379 | Redis | TCP |
| 8080 | Alt HTTP | TCP |
DNS
dig example.com # Full DNS query
dig +short example.com # Just IP
dig @8.8.8.8 example.com # Use specific DNS server
dig MX example.com # Mail records
dig NS example.com # Name servers
dig ANY example.com # All records
/etc/hosts — Local Override
# /etc/hosts
127.0.0.1 localhost
10.0.0.5 myserver.local
getent hosts myserver.local # Resolve using system config
HTTP Tools
curl -I https://site.com # Headers only
curl -v https://site.com # Verbose
curl -L https://site.com # Follow redirects
curl -X POST -d '{"k":"v"}' -H "Content-Type: application/json" https://api.site.com
curl -u user:pass https://site.com # Basic auth
curl -o file.zip https://site.com/file.zip # Save to file
wget https://site.com/file.zip # Download
wget -c https://site.com/big.iso # Continue partial
wget -r -l 1 https://site.com/ # Recursive (1 level)
Connectivity Testing
ping -c 4 8.8.8.8 # ICMP ping (4 packets)
ping -c 4 example.com # Ping hostname
traceroute 8.8.8.8 # Trace route (install traceroute)
mtr 8.8.8.8 # Continuous traceroute (install mtr)
nc -zv example.com 443 # Test TCP port (netcat)
nc -zv example.com 22 # Test SSH port
nmap -p 80,443 example.com # Port scan (install nmap)
Firewall (ufw — Uncomplicated Firewall)
sudo ufw status # Check status
sudo ufw enable # Enable firewall
sudo ufw disable # Disable
sudo ufw allow 22/tcp # Allow SSH
sudo ufw allow 80/tcp # Allow HTTP
sudo ufw allow 443/tcp # Allow HTTPS
sudo ufw allow from 10.0.0.0/24 # Allow subnet
sudo ufw delete allow 8080/tcp # Remove rule
sudo ufw reset # Reset all rules
iptables (Lower Level)
sudo iptables -L -n -v # List rules
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables-save > /etc/iptables/rules.v4 # Persist (iptables-persistent)
SSH Tunneling
# Local forward: client:8080 → server:80
ssh -L 8080:localhost:80 user@server
# Access: curl localhost:8080 on client
# Remote forward: server:8080 → client:80
ssh -R 8080:localhost:80 user@server
# Access: curl localhost:8080 on server
# Dynamic proxy (SOCKS5)
ssh -D 1080 user@server
# Configure browser: SOCKS5 proxy localhost:1080
# Background tunnel
ssh -f -N -L 8080:localhost:80 user@server
# -f = background, -N = no command
Practice
# 1. Check interfaces and IPs
ip a
ip route
# 2. See what's listening
ss -tulpn
# 3. Test DNS
dig +short google.com
dig @1.1.1.1 google.com
# 4. HTTP test
curl -I https://httpbin.org/get
curl -v https://httpbin.org/get 2>&1 | head -20
# 5. Connectivity
ping -c 3 1.1.1.1
nc -zv 1.1.1.1 53
# 6. Firewall
sudo ufw status
sudo ufw allow 8080/tcp
# 7. SSH tunnel test (run in background)
ssh -f -N -L 8080:localhost:80 ubuntu@your-vps
curl localhost:8080
# Kill tunnel: pkill -f "ssh -f -N -L 8080"
💻 实战命令速查
ip a
Show all network interfaces and IPs
$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536
inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500
inet 10.0.0.5/24 brd 10.0.0.255 scope global eth0
inet6 fe80::a00:27ff:fe12:3456/64 scope linkip route
Show routing table
$ ip route
default via 10.0.0.1 dev eth0
10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.5ss -tulpn
Show listening ports (TCP/UDP) with process
$ ss -tulpn
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:* pid=123,comm=systemd-resolve
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* pid=456,comm=sshd
tcp LISTEN 0 128 0.0.0.0:80 0.0.0.0:* pid=789,comm=nginxcurl -I https://example.com
HTTP HEAD request (headers only)
$ curl -I https://example.com
HTTP/2 200
content-type: text/html; charset=UTF-8
server: ECS (nyb/1D2C)
...curl -v https://example.com
Verbose HTTP request/response
$ curl -v https://example.com
* Trying 93.184.216.34:443...
* Connected to example.com (93.184.216.34) port 443
> GET / HTTP/2
> Host: example.com
...wget https://example.com/file.zip
Download file
$ wget https://example.com/file.zip
--2024-11-01 10:00:00-- https://example.com/file.zip
Resolving example.com... 93.184.216.34
Connecting... connected.
Saving to: 'file.zip'dig example.com
DNS lookup (detailed)
$ dig example.com
;; ANSWER SECTION:
example.com. 86400 IN A 93.184.216.34dig +short example.com
DNS lookup (just IP)
$ dig +short example.com
93.184.216.34ping -c 4 8.8.8.8
Test connectivity (ICMP)
$ ping -c 4 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data
64 bytes from 8.8.8.8: icmp_seq=1 ttl=117 time=12.3 msnc -zv example.com 443
Test TCP port connectivity
$ nc -zv example.com 443
Connection to example.com 443 port [tcp/https] succeeded!ufw status
Check firewall status
$ sudo ufw status
Status: active
To Action From
-- ------ ----
22/tcp ALLOW Anywhere
80/tcp ALLOW Anywhere
443/tcp ALLOW Anywhereufw allow 8080/tcp
Allow port through firewall
$ sudo ufw allow 8080/tcp
Rule added
Rule added (v6)ssh -L 8080:localhost:80 user@server
SSH local port forwarding
$ ssh -L 8080:localhost:80 ubuntu@server
# Now localhost:8080 on client → server:80ssh -R 8080:localhost:80 user@server
SSH remote port forwarding
$ ssh -R 8080:localhost:80 ubuntu@server
# server:8080 → client:80