Networking

Networking is the backbone of the internet, services, and systems that communicate, coordinate, orchestrate, and share information. The network is the operator’s battlespace.

The five-layer TCP/IP stack on Linux:

        flowchart LR
    A["Application  HTTP  DNS  SSH  SMTP  ..."]
    B["Transport  TCP    UDP"]
    C["Network  IPv4  IPv6  ICMP"]
    D["Link  eth0  wlan0  lo"]
    E["Physical  copper  fiber  radio"]
    A --- B --- C --- D --- E
    

Question	Command
Interfaces and IPs?	ip -br a
Default route?	ip route
What is listening locally?	ss -tulpn
Active connections?	ss -tan state established
Reachable?	ping host / nc -zv host port
Resolve a name?	getent hosts host / dig host
Capture packets	sudo tcpdump -i eth0 -nn
Show the firewall	sudo nft list ruleset

Foundations

OSI Model

The seven-layer reference. The numbering operators still use as shorthand (L2 switch, L7 proxy).

OSI Model

TCP/IP

The protocol stack underneath every networking command. Each layer maps to a Linux data structure.

TCP/IP

UDP

Connectionless transport. DNS, NTP, DHCP, mDNS, SNMP, syslog, QUIC, VoIP, game traffic.

UDP

Packets

Packet anatomy. Layer headers, payloads, framing.

Packets

Configuration

Files

On-disk configuration and runtime files. The source of truth for what the box does at the next boot.

Files

Interfaces

NICs, virtual links, bridges, tunnels, loopback. ip is the modern tool.

Interfaces

Routing

Routing table, longest-prefix match, default route, and policy routing.

Routing

NetworkManager

The default connectivity daemon on most desktops and many servers. nmcli and connection profiles.

NetworkManager

Sockets and Ports

What is listening, what is connected, who owns each socket. ss and lsof -i.

Sockets and Ports

Reachability

Can this host talk to that host on that port? ping, nc, traceroute, mtr.

Reachability

DNS

Name resolution through the system resolver chain. getent, dig, resolvectl.

DNS

DHCP

Dynamic address handout. IPs, gateways, DNS, hostnames, options on a LAN.

DHCP

Application protocols

HTTP

curl and wget against HTTP. Each method through both clients with common flags.

HTTP

QUIC

The UDP-based transport underneath HTTP/3. Reliability, ordering, encryption, multiplexing.

QUIC

SSL/TLS

The encryption layer wrapping almost every modern protocol. openssl and the ecosystem.

SSL/TLS

SSH

The default operator transport. Encrypted shells, file copy, port forwarding, key-based auth.

SSH

SMTP

How email moves between servers. HELO, MAIL FROM, RCPT TO, DATA, QUIT.

SMTP

SNMP

Legacy network-gear management on UDP 161 / 162. The monitoring backbone and a standing pentest target.

SNMP

SMB

Windows file and printer sharing. Samba, smbclient, mount.cifs.

SMB

FTP

The original file transfer protocol. Plaintext, two connections, NAT-hostile. Operators meet it on legacy systems.

FTP

RDP

Microsoft’s display protocol for graphical remote sessions. TCP/UDP 3389.

RDP

Advanced

eBPF

Kernel VM running sandboxed programs at network, syscall, tracing, and security hooks.

eBPF

Operator workflows

Common Tasks

Muscle-memory responses for inventory, triage, and quick capture on contact.

Common Tasks