Linux Networking Fundamentals

Linux Networking Fundamentals

Understanding how Linux manages network interfaces, connections, and traffic is a core skill for any cybersecurity professional. Whether you are hardening a server, responding to an incident, or performing a vulnerability assessment, you need to move quickly and accurately at the command line. This lesson covers the tools and concepts you will use every day on the job.

Network Interfaces and the ip Suite

Linux refers to each physical or virtual network adapter as a network interface. Common names are `eth0`, `ens33`, `ens3`, or `lo` (the loopback). The `ip` command (part of the `iproute2` package) is the modern replacement for the older `ifconfig`.

To view current interface addresses, run `ip addr show`. To view the routing table, run `ip route show`. These commands give you the information you need to understand how the host reaches other systems.

Configuring a static IP address means telling the system to use a fixed address rather than requesting one from DHCP. On Ubuntu/Debian systems that use Netplan, you edit a YAML file under `/etc/netplan/` and then apply it with `sudo netplan apply`. On systems using NetworkManager (common on Red Hat-family and many desktops), you use `nmcli` to set addresses and routes. Always verify your configuration persists after a reboot — a setting that disappears on restart was never truly configured.

After setting an address, confirm connectivity with `ping <destination>` and trace the path packets take with `traceroute <destination>` (or `tracepath` if `traceroute` is not installed). Both tools rely on ICMP; firewalls that block ICMP will cause them to show timeouts, which is itself useful information.

Listing Open Ports and Connections

Knowing what network ports are open on a system is essential for hardening. An unexpected open port can indicate a misconfigured service, unauthorized software, or an active compromise.

`ss` (socket statistics) is the modern tool for listing connections and listening ports. The flag combination `ss -tlnp` is particularly useful:

• `-t` shows TCP sockets
• `-l` shows only listening sockets
• `-n` shows numeric port numbers (avoids slow DNS lookups)
• `-p` shows the process name and PID that owns each socket

`netstat` from the `net-tools` package provides similar output with `netstat -tlnp` and is still widely found on older systems and in exam scenarios. When you identify a port that should not be open on a hardened server — such as Telnet (port 23) or an unknown service on a high-numbered port — document it and investigate the owning process before taking action.

Capturing and Analyzing Traffic with tcpdump and Wireshark

`tcpdump` is a command-line packet capture tool available on nearly every Linux system. To capture traffic on interface `ens33` and save it for later analysis, run:

```

sudo tcpdump -i ens33 -w capture.pcap

```

Press Ctrl+C to stop after your desired interval, or use the `-G` flag with `-W` for timed rotation. The resulting `.pcap` file can be opened in Wireshark, a graphical protocol analyzer, for detailed inspection.

In Wireshark, two patterns are fundamental to recognize:

1. DNS query and response — Look for packets using the DNS protocol (UDP or TCP port 53). The query packet asks for an address; the response returns it. The Wireshark display filter `dns` isolates these quickly.

2. TCP three-way handshake — Every TCP connection begins with three packets: SYN (client to server), SYN-ACK (server to client), and ACK (client to server). In Wireshark, filter by a specific IP or port and look for this flag sequence in the Info column.

Understanding these patterns lets you confirm normal operation, spot scanning activity, or identify data exfiltration attempts.

Safety and Responsible Use

Packet capture is a powerful and potentially sensitive activity. Always obtain written authorization before capturing traffic on any network you do not personally own. In a professional environment, unauthorized packet capture may violate organizational policy, federal law under the Electronic Communications Privacy Act, or both. In this lab you are working on your own VM and virtual network — traffic capture there is appropriate. Never redirect captures from your VM environment onto a production or campus network segment.

When running commands with `sudo`, confirm you understand what each command does before executing it. Misconfiguring a network interface can cause loss of remote access to a system; in a production context that may require physical console access to recover. Always document your steps so changes can be reversed.

Connecting to Security Credentials

The concepts in this lesson map directly to objectives in CompTIA Security+ (network configuration, traffic analysis, hardening) and CompTIA CySA+ (host and network analysis, identifying anomalous traffic). The ISC2 CC exam also covers network concepts including protocols, ports, and basic traffic analysis. Mastery of Linux networking tools gives you practical skill behind the theory those exams test.