This lab covers Linux networking tools from the iproute2 suite (ip, ss) which replace the older ifconfig/netstat commands. You'll inspect interfaces, routes, sockets, and read directly from the kernel's /proc/net/ filesystem.
Step 1: Install iproute2 and Explore ip addr
The ip command is the modern replacement for ifconfig. It's part of the iproute2 package.
💡 ip addr show lists all network interfaces with their IPv4 and IPv6 addresses. The lo interface is the loopback (127.0.0.1) and eth0 is the primary network interface in Docker containers.
📸 Verified Output:
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0@if1113: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 06:11:d6:6b:d9:ce brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 172.17.0.6/16 brd 172.17.255.255 scope global eth0
valid_lft forever preferred_lft forever
Step 2: Inspect Network Links with ip link
ip link shows layer-2 (data link) information — MAC addresses and interface flags.
💡 Interface flags like UP, LOWER_UP, and BROADCAST tell you the operational state. LOWER_UP means the physical/virtual link is active. mtu 1500 is the standard Ethernet Maximum Transmission Unit.
📸 Verified Output:
Step 3: View Routing Table with ip route
The routing table tells the kernel how to forward packets to their destinations.
💡 The default route (gateway) is where packets go when no more-specific route matches. proto kernel means the route was added automatically by the kernel when the interface came up. src shows the preferred source IP for outgoing packets.
📸 Verified Output:
Step 4: Socket Statistics with ss
ss (socket statistics) replaces netstat. It's faster and reads directly from the kernel.
💡 Flags: -t = TCP, -u = UDP, -l = listening only, -n = numeric (no DNS resolution), -p = show process. On a minimal Docker container with no services running, ss -tlnp will show an empty table — that's expected and correct.
📸 Verified Output:
Step 5: Reading /proc/net/ Virtual Filesystem
The Linux kernel exposes network state through /proc/net/. These are not real files — they're kernel data structures rendered as text.
💡 /proc/net/tcp shows connections in hex format: local_address is IP:PORT in little-endian hex. State 06 = TIME_WAIT, 01 = ESTABLISHED. Tools like ss and netstat parse this file for you.
📸 Verified Output:
Step 6: Hostname Resolution
Linux resolves hostnames through multiple mechanisms configured in /etc/nsswitch.conf.
💡 Resolution order: /etc/hosts first (for static entries), then DNS servers listed in /etc/resolv.conf. Docker containers use 8.8.8.8 as their default nameserver. The getent command queries NSS (Name Service Switch) the same way programs do.
📸 Verified Output:
Step 7: Network Namespaces — Isolation Intro
Network namespaces provide isolated network stacks (used by Docker, Kubernetes, VPNs).
💡 Docker itself uses network namespaces — each container gets its own isolated network stack. ip netns add requires CAP_SYS_ADMIN which is restricted in standard Docker containers (run with --privileged on a dev machine to experiment). The @if1113 suffix in eth0@if1113 shows the veth peer interface index in the host namespace.
📸 Verified Output:
Step 8: Capstone — Network Audit Script
Scenario: You're a sysadmin who needs a quick network health snapshot of a new server. Write a script that collects key networking info.
💡 This pattern — collect interface info, routes, sockets, DNS config, and connectivity in sequence — is a standard first-response checklist when diagnosing network issues. Save it as /usr/local/bin/netaudit and chmod +x for reuse.
# List existing network namespaces
ip netns list
# Attempt to create one (requires elevated privileges)
# ip netns add testns
# View netns in /proc (each process's namespace)
ls -la /proc/1/ns/net 2>/dev/null || echo "No access to PID 1 ns"
# Check /proc/net/if_inet6 for IPv6 interface state
cat /proc/net/if_inet6
# ip netns list (empty — no named namespaces in container)
# /proc/net/if_inet6
00000000000000000000000000000001 01 80 10 80 lo
