Networking commands ¶

Usage 🐚: merge of multiple commands (route, arp, ipconfig). Note that ipconfig is still used on Windows.

Example 🔥:

Show all interfaces (a=addr=address, l=link, s=show)

$ ip a
$ ip -4 a s # only IPV4
$ ip -brief a s # only a brief description
$ ip l

Show one interface "eth0" addresses/links

$ ip addr show dev0
$ ip link show dev0

Useful option 🧪: -r to show names instead of IPs.

Show routing table (r=route)

$ ip r

To add a route, you need a "_dest", a "_gateway", and an "_interface". See Routing.

$ ip r add _dest via _gateway dev _interface

Show ARP cache (n=neigh=neighbor)

$ ip n

Usage 🐚: on Linux, ipconfig is deprecated over ip a, but on Windows, it's still the command used.

Example 🔥 - Linux:

Show information about the network. Note that RT = received, TX = emitted. Print info about all interfaces:

$ ifconfig -a

Only one interface "eth0"

$ ifconfig eth0

Example 🔥 - Windows:

List more or less information about each network interface.

CMD> ifconfig
CMD> ipconfig /all

Release an IP address

CMD> ipconfig /release

Request a new IP address

CMD> ipconfig /release

Usage 🐚: list open ports

Example 🔥:

$ ss
$ ss -a # all
$ ss -4 # ipv4
$ ss -t # tcp
$ ss -u # udp
$ ss -l # listening
$ ss -n # no resolve

Usage 🐚: show network information and stats.

Example 🔥:

$ netstat -l # list ports
$ netstat -i # list interfaces
$ netstat -r # routes
$ netstat -rn # routable networks

$ netstat -a # all ports
$ netstat [...] -t # TCP only
$ netstat [...] -u # UDP only
$ netstat -s # stats per protocol
$ netstat -p # service name + pid
$ netstat -tulpn # common usage

Usage 🐚: you can create a server, and create clients, and exchange messages between them.

Variants: ncat, netcat.

Example 🔥 - server: listen on a port

$ nc ip -l port
$ nc ip -l -p port
$ nc ip -lp port
$ nc ip -lnvp port # 👈
# keep listening after last client disconnect
$ nc ip -lnvpk port
$ nc --source-port port [...]

Example 🔥 - client: connect to a server at IP using a specific port

$ nc ip port
$ nc ip -p port

➡️ Connect to a python webserver...

➡️ Use -vv for quite verbose.

Usage 🐚: trace the route that a packet is taking.

Example 🔥:

$ traceroute ip

Specify an interface, such as eth0

$ traceroute ip -i eth0

Use TCP/SYN

$ sudo traceroute ip -T

Usage 🐚: monitor network.

Example 🔥:

• -f "filter": see wireshark capture filters
• -F file: read from a file

$ tshark -i eth0 -f "host some_ip"
$ tshark -i eth0 -w /tmp/test.pcap

Reading a capture:

$ tshark -r xxx.pcap
$ tshark -r xxx.pcap -T json

Usage 🐚: define rules for incoming/outgoing traffic.

Example 🔥:

List tables

$ sudo iptables -L

DROP any packet using TCP, on port 22, having our machine as destination, and emitted by 172.16.1.1.

$ sudo iptables -t filter -A INPUT -s 172.16.1.1 -p tcp --dport 22 -j DROP

Hide the source IP address using 50.50.50.50, for any packet passing by our interface "eth2".

$ sudo iptables -t NAT -A POSTROUTING -o eth2 -j SNAT --to-source 50.50.50.50

Common chains are:

• INPUT: incoming traffic
• OUTPUT: outgoing traffic
• FORWARD: traffic passing through

• -t table: FILTER by default
• -A chain: add a rule at the end of the chain
• -I chain: add a rule at the start of the chain
• -D chain: delete a rule
• -o interface: exit via "interface"
• -i interface: enter using "interface"
• -j action: a chain or:
  • SNAT/DNAT: translation source/destination
  • ACCEPT: allow
  • DENY/DROP: deny without notifying the sender
  • REJECT: deny, but notify the sender
• -s ip: source (separated by colons)
• -d ip: destination (s(separated by colons)
• --sport port: source port
• --dport port: destination port
• --to ip: if SNAT/DNAT, the new source/destination
• -p protocol: which protocol

Note: you can use ! (NOT), such as -s !127.0.0.1 meaning every packet not having "127.0.0.1" as source will be filtered.

Usage 🐚: define rules for incoming/outgoing traffic. It's replacing the legacy iptables, and supposedly more scalable and performant.

Example 🔥:

A table is used to store chains.

$ nft add table t_name # create
$ nft list table t_name # list chain+rules
$ nft delete table t_name # delete

A chain is a suite of rules.

# incoming traffic
$ nft add chain t_name c_name { type filter hook input priority 0 \; }
# outgoing traffic
$ nft add chain t_name c_name { type filter hook output priority 0 \; }

Add rules.

# accept traffic from port 22
$ nft add fwfilter c_name tcp sport 22 accept
# drop traffic to port 22
$ nft add fwfilter c_name tcp dport 22 drop

• sport/dport: based on the port
• saddr/daddr: based on the IP
• accept/drop: accept or drop the packet
• limit rate 5/minute: example to limit rate