Skip to content

Click on each book below to review & buy on Amazon.

As an Amazon Associate, I earn from qualifying purchases.

LPI Linux Essentials Exam 010-160 - Topic 4.4 - Querying Network Information

Introduction

Querying network information on a Linux system involves using various command-line tools to gather data about the system's network interfaces, routing tables, connection statistics, and more. These tools are essential for network troubleshooting, configuration, and understanding the network setup of the system. Each tool provides unique features and outputs, making them useful for different aspects of network analysis.

In the upcoming sections, we will explore several key tools:

  1. route, ip route show: These commands are used to display and manipulate the IP routing table.
  2. ip link show: This command provides information about network interfaces, including state, MAC addresses, and more.
  3. ifconfig, ip addr show: These commands offer details about network interfaces, including IP addresses, broadcast addresses, and other configuration details.
  4. netstat, ss: These tools are used for displaying network connections, routing tables, interface statistics, masquerade connections, and multicast memberships.
  5. ping: An essential network tool used to test the reachability of hosts on an IP network and measure round-trip time for messages sent to the host.

Each section will delve into how these tools are used, their syntax, and the type of information they provide, ensuring a comprehensive understanding of querying network information in a Linux environment.

route & ip route show Commands

In Linux, efficient network management often involves inspecting and managing the IP routing table. This is crucial for understanding how data packets navigate through an IP network. Two primary commands used for this purpose are route and ip route show, each offering unique insights and functionalities.

route Command

The route command, a staple in UNIX and Linux systems, serves as a fundamental tool for viewing and modifying the network routing table. Although this command is still prevalent in many systems, it's gradually being overshadowed by the ip command, which provides more sophisticated features.

Usage of route -n

The command route -n displays the routing table, with the -n flag substituting IP addresses for hostnames for faster, easier interpretation. An example output is as follows:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 eth0

Interpreting the Output

  • Destination: The network or host to which the route applies.
  • Gateway: The gateway address where packets are sent.
  • Genmask: The netmask for the destination.
  • Flags: Indicators such as U (route is up) and G (use gateway).
  • Metric: Determines the priority of the route.
  • Ref: Number of references to this route.
  • Use: Count of lookups for the route.
  • Iface: Network interface used for the route.

ip route show Command

The ip route command, part of the iproute2 package, is a more advanced tool for managing routing tables in Linux.

Using ip route show

The ip route show command displays the current state of the routing table in a format that's often easier to read and understand. An example output might be:

default via 192.168.1.1 dev eth0 
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.2

Understanding the Output

  • default via [gateway]: Shows the default route (i.e., where packets are sent if their destination is not in the table).
  • [network]/[mask]: The network and its subnet mask.
  • dev [device]: The network interface used.
  • proto kernel: Indicates the route was installed by the kernel during auto-configuration.
  • scope link: The route is valid only for this device.
  • src [IP]: Preferred source address when sending to the destination.

Both route and ip route show are valuable tools in Linux for network management. While route offers legacy support, ip route brings a more modern approach with additional features.

The ip link show command, a part of the iproute2 package in Linux, is a critical tool for displaying comprehensive information about network interfaces. It's indispensable for inspecting the state, configuration, and various properties of network interfaces on a Linux system.

When executed without additional parameters, ip link show lists all available network interfaces on the system, along with a wealth of details about each. The output provides insight into the interface name, operational state (up or down), MAC (Media Access Control) address, and other vital configuration aspects.

Example Output and Interpretation

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether 01:23:45:67:89:ab brd ff:ff:ff:ff:ff:ff
  • Interface Identifier: For example, 1: for loopback (lo) and 2: for Ethernet (eth0).
  • Interface Name: Such as lo for loopback and eth0 for Ethernet.
  • Flags: Indicate specific attributes like LOOPBACK, UP, LOWER_UP, BROADCAST, and MULTICAST.
  • MTU (Maximum Transmission Unit): The size of the largest packet that can be transmitted.
  • qdisc (Queueing Discipline): The type of queueing discipline used for packet transmission.
  • State: Shows the operational state (e.g., UP, DOWN, or UNKNOWN).
  • Mode and Group: Default mode and group settings.
  • qlen (Queue Length): The length of the transmit queue.
  • Link/Type: Specifies the link type like link/loopback or link/ether.
  • MAC Address: The physical hardware address.
  • brd (Broadcast Address): The broadcast address used by the interface.

Practical Applications

The ip link show command is especially valuable for:

  • Network Administrators: Provides an immediate overview of all network interfaces and their statuses, aiding in network management and troubleshooting.
  • System Diagnostics: Helps in diagnosing network issues by offering a snapshot of the operational status and configuration of network interfaces.
  • Scripting and Automation: Can be utilized in scripts for automated network monitoring or configuration tasks.

ifconfig and ip addr show Commands

In the realm of Linux network configuration, ifconfig and ip addr show are pivotal commands for displaying and managing network interface configurations. ifconfig is the traditional tool found in older Linux distributions, while ip addr show, part of the iproute2 package, is the preferred choice in modern Linux systems due to its advanced capabilities. It's important to note that ifconfig is considered deprecated in many contemporary Linux distributions.

ifconfig Command

ifconfig, executed without any parameters, displays detailed information about all active network interfaces. This information encompasses the interface name, IP address, netmask, broadcast address, MTU (Maximum Transmission Unit) size, and RX/TX (Receive/Transmit) packet statistics. Example output would be:

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.2  netmask 255.255.255.0  broadcast 192.168.1.255
        ether 01:23:45:67:89:ab  txqueuelen 1000  (Ethernet)
        RX packets 100000  bytes 123456789 (117.6 MiB)
        TX packets 200000  bytes 987654321 (941.2 MiB)

Interpreting the Output

  • Interface Name: e.g., eth0 for an Ethernet interface.
  • Flags: Indicate the status (e.g., UP, BROADCAST).
  • MTU: Maximum packet size the interface can handle.
  • Inet: The IPv4 address assigned to the interface.
  • Netmask: The subnet mask.
  • Broadcast Address: The broadcast address used for sending packets to all devices on the network.
  • Ethernet Address: The physical MAC address.
  • RX/TX Packets and Bytes: The count of received and transmitted packets and bytes.

Exploring the ip addr show Command

ip addr show serves a similar function to ifconfig, providing detailed information about all network interfaces. It displays the IP address, network prefix in CIDR notation, broadcast address, and the state of the interface. Example output would be:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    inet 127.0.0.1/8 scope host lo
    ...
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    inet 192.168.1.2/24 brd 192.168.1.255 scope global dynamic eth0
    ...

Understanding the Output

  • Interface Identifier and Name: Like 1: lo for loopback and 2: eth0 for Ethernet.
  • Flags: Detail the interface's characteristics (e.g., LOOPBACK, UP).
  • MTU: The maximum transmission unit size.
  • qdisc: Queueing discipline.
  • State: The operational state of the interface.
  • Inet: IPv4 address with CIDR notation indicating the subnet mask.
  • brd: Broadcast address.

While both ifconfig and ip addr show provide essential information for network configuration and troubleshooting, ip addr show is generally recommended in modern Linux environments. Its advanced features and more comprehensive output make it a superior choice for contemporary network management tasks.

netstat & ss Commands

In Linux, netstat and ss are powerful tools used for displaying network connections, routing tables, interface statistics, and other network-related information. While netstat has been a long-standing utility in many Unix-like systems, ss is a newer tool and is intended to replace netstat due to its more efficient and detailed output.

netstat Command

netstat is used to display a variety of network-related information. It has multiple options that allow users to view different types of data.

  • To view all active connections, the command netstat -atun is used. This shows TCP and UDP connections, their states, local and remote addresses, and port numbers. An example output might be:

    Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp        0      0 192.168.1.2:22          192.168.1.3:53922       ESTABLISHED
udp        0      0 0.0.0.0:68              0.0.0.0:*

  • For viewing the routing table, netstat -rn is used. This provides a similar output to the route -n command, showing the routing table with numeric addresses.

ss Command

ss is a utility that provides information about sockets. It's faster and provides more detailed information compared to netstat.

  • To list all open TCP and UDP ports, the command ss -tuln is used. This displays a list of listening ports along with their addresses and the total number of connections. An example output might look like:

    State      Recv-Q Send-Q    Local Address:Port      Peer Address:Port                
LISTEN     0      128             0.0.0.0:22             0.0.0.0:*                   
ESTAB      0      0           192.168.1.2:22         192.168.1.3:53922              
UNCONN     0      0               0.0.0.0:68             0.0.0.0:*

  • ss can also provide detailed socket statistics, like the ss -s command, which shows a summary of socket usage across the system.

Both tools are valuable for network troubleshooting and monitoring. However, for users working with modern Linux systems or dealing with large-scale or complex networks, ss is generally the more efficient and informative choice.

ping Command

The ping command is one of the most widely used and fundamental tools in network diagnostics and troubleshooting. It operates by sending Internet Control Message Protocol (ICMP) echo request packets to a specified network host and then waits for an ICMP response. By doing this, ping measures the round-trip time for messages sent from the originating host to a destination computer and reports errors if any.

The basic syntax for using ping is ping [hostname or IP address]. When executed, it sends a series of packets to the specified address and provides a detailed account of each response, including time measurements.

For example, running ping www.example.com might produce an output like:

PING www.example.com (93.184.216.34) 56(84) bytes of data.
64 bytes from 93.184.216.34 (93.184.216.34): icmp_seq=1 ttl=56 time=11.632 ms
64 bytes from 93.184.216.34 (93.184.216.34): icmp_seq=2 ttl=56 time=10.726 ms
64 bytes from 93.184.216.34 (93.184.216.34): icmp_seq=3 ttl=56 time=10.873 ms

In this output, each line represents a reply from the host www.example.com. It shows the sequence number of the ICMP message (icmp_seq), the Time to Live (ttl) value, and the round-trip time (time) in milliseconds.

Key Features and Uses

  • Connectivity Check: ping is primarily used to check the connectivity to a host on an IP network.
  • Network Performance Measurement: It measures the time it takes for packets to travel to a host and back, which is useful for assessing network speed and performance.
  • Troubleshooting: ping helps in diagnosing network issues. A lack of response indicates network problems, while high response times could point to network congestion or other related issues.

The ping command is a simple yet powerful tool for network administrators and users alike. Its ability to quickly ascertain network connectivity and performance makes it an essential part of any network troubleshooting toolkit.

Conclusion

This guide has provided an overview of essential Linux networking commands, each serving a unique purpose in network management and troubleshooting. We explored route and ip route show for managing the IP routing table, ip link show for inspecting network interfaces, ifconfig and ip addr show for interface configuration, netstat and ss for socket and connection details, and the ping command for network connectivity and performance testing.

Understanding these commands is fundamental for anyone working with Linux networks. They offer powerful capabilities to inspect, configure, and troubleshoot network interfaces and connections. While some commands like ifconfig and route are traditional and still in use, modern alternatives like ip addr show, ip route show, and ss are recommended for their advanced features and detailed output.

Support DTV Linux

Click on each book below to review & buy on Amazon. As an Amazon Associate, I earn from qualifying purchases.

NordVPN ®: Elevate your online privacy and security. Grab our Special Offer to safeguard your data on public Wi-Fi and secure your devices. I may earn a commission on purchases made through this link.