This tutorial covers TCP/IP networking and system configuration basics. Linux can support multiple network devices. The device names are numbered and begin at zero and count upwards. For example, a computer running two ethernet cards will have two devices labeled /dev/eth0 and /dev/eth1. Linux network configuration, management, monitoring and system tools are covered in this tutorial.
TCP/IP Network Configuration Files:
File: /etc/resolv.conf - host name resolver configuration file
search name-of-domain.com - Name of your domain or ISP's domain if using their name server
nameserver XXX.XXX.XXX.XXX - IP address of primary name server
nameserver XXX.XXX.XXX.XXX - IP address of secondary name server
This configures Linux so that it knows which DNS server will be resolving domain names into IP addresses. If using DHCP client, this will automatically be sent to you by the ISP and loaded into this file as part of the DHCP protocol. If using a static IP address, ask the ISP or check another machine on your network. Red Hat/Fedora GUI: /usr/sbin/system-config-network (select tab "DNS".
File: /etc/hosts - locally resolve node names to IP addresses
127.0.0.1 your-node-name.your-domain.com localhost.localdomain localhost XXX.XXX.XXX.XXX node-name
Note when adding hosts to this file, place the fully qualified name first. (It helps sendmail identify your server correctly) i.e.: XXX.XXX.XXX.XXX superserver.yolinux.com superserver This informs Linux of local systems on the network which are not handled by the DNS server. (or for all systems in your LAN if you are not using DNS or NIS) Red Hat/Fedora GUI: /usr/sbin/system-config-network (select tab "Hosts".
File: /etc/nsswitch.conf - System Databases and Name Service Switch configuration file
hosts: files dns nisplus nis This example tells Linux to first resolve a host name by looking at the local hosts file(/etc/hosts), then if the name is not found look to your DNS server as defined by /etc/resolv.conf and if not found there look to your NIS server.
In the past this file has had the following names: /etc/nsswitch.conf, /etc/svc.conf, /etc/netsvc.conf, ... depending on the distribution.
Fedora / Red Hat Network Configuration Files:
/etc/sysconfig/network
Red Hat network configuration file used by the system during the boot process.
File: /etc/sysconfig/network-scripts/ifcfg-eth0 Configuration settings for your first ethernet port (0). Your second port is eth1.
File:
/etc/modprobe.conf (kernel 2.6)
/etc/modules.conf (kernel 2.4)
(or for older systems: /etc/conf.modules) Example statement for Intel ethernet card:
alias eth0 eepro100 Modules for other devices on the system will also be listed. This tells the kernel which device driver to use if configured as a loadable module. (default for Red Hat)
Fedora / Red Hat Network GUI Configuration Tools:
The following GUI tools edit the system configuration files. There is no difference in the configuration developed with the GUI tools and that developed by editing system configuration files directly.
TCP/IP ethernet configuration:
Network configuration: /usr/sbin/system-config-network (FC-2/3) GUI shown here ---> /usr/bin/redhat-config-network (/usr/bin/neat) (RH 7.2+ FC-1)
Text console configuration tool: /usr/sbin/system-config-network-tui (Text User Interface (TUI) for Fedora Core 2/3) /usr/bin/redhat-config-network-tui (RH 9.0 - FC-1)
Text console network configuration tool. First interface only - eth0: /usr/sbin/netconfig
/usr/bin/netcfg (GUI) (last available with RH 7.1) Gnome Desktop:
Gnome Desktop Network Configuration /usr/bin/gnome-network-preferences (RH 9.0 - FC-3) Proxy configuration. Choose one of three options:
Direct internet connection
Manual proxy configuration (specify proxy and port)
Automatic proxy configuration (give URL)
Assigning an IP address:
Computers may be assiged a static IP address or assigned one dynamically.
Static IP address assignment:
Choose one of the following methods:
Command Line: /sbin/ifconfig eth0 192.168.10.12 netmask 255.255.255.0 broadcast 192.168.10.255 Network address by convention would be the lowest: 192.168.10.0 Broadcast address by convention would be the highest: 192.168.10.255 The gateway can be anything, but following convention: 192.168.10.1
Note: the highest and lowest addresses are based on the netmask. The previous example is based on a netmask of 255.255.255.0
Red Hat / Fedora GUI tools:
/usr/bin/neat Gnome GUI network administration tool. Handles all interfaces. Configure for Static IP or DHCP client. (First available with Red Hat 7.2.)
/usr/bin/netcfg (Handles all interfaces) (last available in Red Hat 7.1)
Red Hat / Fedora Console tools:
/usr/sbin/system-config-network-tui (Text User Interface)
/usr/sbin/netconfig (Only seems to work for the first network interface eth0 but not eth1,...)
Directly edit configuration files/scripts. See format below.
The ifconfig command does NOT store this information permanently. Upon reboot this information is lost. (Manually add the commands to the end of the file /etc/rc.d/rc.local to execute them upon boot.) The commands netcfg and netconfig make permanent changes to system network configuration files located in /etc/sysconfig/network-scripts/, so that this information is retained.
The IANA has allocated IP addresses in the range of 192.168.0.0 to 192.168.255.255 for private networks.
Helpful tools:
Network Calculators: Subnet mask calculator, node calculator, mask inverter, ...
IP subnet calculator
Ubuntu / Debian IP Configuration Files:
File: /etc/network/interfaces
Static IP example:
auto loiface lo inet loopbackauto eth0iface eth0 inet static address 208.88.34.106 netmask 255.255.255.248 broadcast 208.88.34.111 network 208.88.34.104 gateway 208.88.34.110
Dynamic IP (DHCP) example:
auto loiface lo inet loopbackauto eth0iface eth0 inet dhcpauto eth1iface eth1 inet dhcpauto eth2iface eth2 inet dhcpauto ath0iface ath0 inet dhcpauto wlan0iface wlan0 inet dhcpInterfaces:
lo: Loopback interface (network within your system without slowing down for the real ethernet based network)
eth0: First ethernet interface card
wlan0: First wireless network interface
Also see "man interfaces"
Red Hat / Fedora Core IP Configuration Files:
The Red Hat configuration tools store the configuration information in the file /etc/sysconfig/network. They will also allow one to configure routing information.
File: /etc/sysconfig/network
Static IP address Configuration: (Configure gateway address)
NETWORKING=yesHOSTNAME=my-hostname - Hostname is defined here and by command hostname
FORWARD_IPV4=true - True for NAT firewall gateways and linux routers. False for everyone else - desktops and servers.
GATEWAY="XXX.XXX.XXX.YYY" - Used if your network is connected to another network or the internet. Static IP configuration. Gateway not defined here for DHCP client.
OR for DHCP client configuration:
NETWORKING=yesHOSTNAME=my-hostname - Hostname is defined here and by command hostname
(Gateway is assigned by DHCP server.) OR for NIS client configuration:
NETWORKING=yesHOSTNAME=my-hostname - Hostname is defined here and by command hostname
NISDOMAIN=NISProject1 - NIS domain to attach
File (Red Hat/Fedora): /etc/sysconfig/network-scripts/ifcfg-eth0 (S.u.s.e.: /etc/sysconfig/network/ifcfg-eth-id-XX:XX:XX:XX:XX) This file used by the command scripts ifup and ifdown
Static IP address configuration:
DEVICE=eth0BOOTPROTO=staticBROADCAST=XXX.XXX.XXX.255IPADDR=XXX.XXX.XXX.XXX
NETMASK=255.255.255.0
NETWORK=XXX.XXX.XXX.0
ONBOOT=yes - Will activate upon system boot
RHEL4/FC3 additions:
TYPE=Ethernet
HWADDR=XX:XX:XX:XX:XX:XX
GATEWAY=XXX.XXX.XXX.XXX
OR for DHCP client configuration:
DEVICE=eth0ONBOOT=yesBOOTPROTO=dhcpRHEL4/FC3 additions:
IPV6INIT=no
USERCTL=no
PEERDNS=yes
TYPE=Ethernet
HWADDR=XX:XX:XX:XX:XX:XX (Used by script /etc/sysconfig/network-scripts/ifup to bring the various network interfaces on-line) To disable DHCP change BOOTPROTO=dhcp to BOOTPROTO=none
In order for updated information in any of these files to take effect, one must issue the command: service network restart (or: /etc/init.d/network restart)
Changing the host name:
This is a three step process:
Issue the command: hostname new-host-name
Change network configuration file: /etc/sysconfig/network Edit entry: HOSTNAME=new-host-name
Restart systems which relied on the hostname (or reboot):
Restart network services: service network restart (or: /etc/init.d/network restart)
Restart desktop:
Bring down system to console mode: init 3
Bring up X-Windows: init 5 One may also want to check the file /etc/hosts for an entry using the system name which allows the system to be self aware.
The hostname may be changed at runtime using the command: sysctl -w kernel.hostname="superserver"
Network IP aliasing:
Assign more than one IP address to one ethernet card: ifconfig eth0 XXX.XXX.XXX.XXX netmask 255.255.255.0 broadcast XXX.XXX.XXX.255 ifconfig eth0:0 192.168.10.12 netmask 255.255.255.0 broadcast 192.168.10.255 ifconfig eth0:1 192.168.10.14 netmask 255.255.255.0 broadcast 192.168.10.255 route add -host XXX.XXX.XXX.XXX dev eth0 route add -host 192.168.10.12 dev eth0 route add -host 192.168.10.14 dev eth0In this example 0 and 1 are aliases in addition to the regular eth0. The result of the ifconfig command: eth0 Link encap:Ethernet HWaddr 00:10:4C:25:7A:3F inet addr:XXX.XXX.XXX.XXX Bcast:XXX.XXX.XXX.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:14218 errors:0 dropped:0 overruns:0 frame:0 TX packets:1362 errors:0 dropped:0 overruns:0 carrier:0 collisions:1 txqueuelen:100 Interrupt:5 Base address:0xe400 eth0:0 Link encap:Ethernet HWaddr 00:10:4C:25:7A:3F inet addr:192.168.10.12 Bcast:192.168.10.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:5 Base address:0xe400 eth0:1 Link encap:Ethernet HWaddr 00:10:4C:25:7A:3F inet addr:192.168.10.14 Bcast:192.168.10.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:5 Base address:0xe400
Config file: /etc/sysconfig/network-scripts/ifcfg-eth0:0
DEVICE=eth0:0ONBOOT=yesBOOTPROTO=staticBROADCAST=192.168.10.255IPADDR=192.168.10.12NETMASK=255.255.255.0NETWORK=192.168.10.0ONBOOT=yesAliases can also be shut down independently. i.e.: ifdown eth0:0
The option during kernel compile is: CONFIG_IP_ALIAS=y (Enabled by default in Redhat)
Note: The Apache web server can be configured so that different IP addresses can be assigned to specific domains being hosted. See Apache configuration and "configuring an IP based virtual host" in the YoLinux Web site configuration tutorial.
DHCP Linux Client: get connection info: /sbin/pump -i eth0 --status (Red Hat Linux 7.1 and older)
Device eth0 IP: 4.XXX.XXX.XXX Netmask: 255.255.252.0 Broadcast: 4.XXX.XXX.255 Network: 4.XXX.XXX.0 Boot server 131.XXX.XXX.4 Next server 0.0.0.0 Gateway: 4.XXX.XXX.1 Domain: vz.dsl.genuity.net Nameservers: 4.XXX.XXX.1 4.XXX.XXX.2 4.XXX.XXX.3 Renewal time: Sat Aug 11 08:28:55 2001 Expiration time: Sat Aug 11 11:28:55 2001
Activating and De-Activating your NIC:
Commands for starting and stopping TCP/IP network services on an interface:
Activate: /sbin/ifup eth0 (Also: ifconfig eth0 up - Note: Even if no IP address is assigned you can listen.)
De-Activate: /sbin/ifdown eth0 (Also: ifconfig eth0 down) These scripts use the scripts and NIC config files in /etc/sysconfig/network-scripts/
GUI Interface control/configuration:
Start/Stop network interfaces /usr/bin/system-control-network (Fedora Core 2/3) /usr/bin/redhat-control-network (RH 9.0 - FC-1)
Configure Ethernet, ISDN, modem, token Ring, Wireless or DSL network connection: /usr/sbin/system-config-network-druid (FC2/3) /usr/sbin/redhat-config-network-druid (RH 9 - FC-1)
Example 192=128+64
Some addresses are reserved and outside this scope. Loopback (127.0.0.1), reserved class C 192.168.XXX.XXX, reserved class B 172.31.XXX.XXX and reserved class A 10.XXX.XXX.XXX.
Subnet Example:
Your ISP assigns you a subnet mask of 255.255.255.248 for your office.
208.88.34.104 Network Base address
208.88.34.105 Computer 1
208.88.34.106 Computer 2
208.88.34.107 Computer 3
208.88.34.108 Computer 4
208.88.34.109 Computer 5
208.88.34.110 DSL router/Gateway
208.88.34.111 Broadcast address Of the eight addresses, there are six assigned to hardware systems and ultimately only five usable addresses.
Links:
Subnet Cheat Sheet
Subnet calculator
Table of subnets
IP Subnetting, Variable Subnetting, and CIDR (Supernetting)
CISCO.com: Subnet Masking and Addressing
Network Classes:
The concept of network classes is a little obsolete as subnets are now used to define smaller networks. These subnets may be part of a class A, B, C, etc network. For historical reference the network classes are defined as follows:
Class A: Defined by the first 8 bits with a range of 0 - 127. First number (8 bits) is defined by Internic i.e. 77.XXX.XXX.XXX One class A network can define 16,777,214 hosts. Range: 0.0.0.0 - 127.255.255.255
Class B: Defined by the first 8 bits with a range from 128 - 191 First two numbers (16 bits) are defined by Internic i.e. 182.56.XXX.XXX One class B network can define 65,534 hosts. Range: 128.0.0.0 - 191.255.255.255
Class C: Defined by the first 8 bits with a range from 192 - 223 First three numbers (24 bits) are defined by Internic i.e. 220.56.222.XXX One class B network can define 254 hosts. Range: 192.0.0.0 - 223.255.255.255
Class D: Defined by the first 8 bits with a range from 224 - 239 This is reserved for multicast networks (RFC988) Range: 224.0.0.0 - 239.255.255.255
Class E: Defined by the first 8 bits with a range from 240 - 255 This is reserved for experimental use. Range: 240.0.0.0 - 247.255.255.255
Enable Forwarding:Forwarding allows the network packets on one network interface (i.e. eth0) to be forwarded to another network interface (i.e. eth1). This will allow the Linux computer to conect ("ethernet bridge") or route network traffic.
The bridge configuration will merge two (or several) networks into one single network topology. IpTables firewall rules can be used to filter traffic.
A router configuration can support multicast and basic IP routing using the "route" command. IP masquerading (NAT) can be used to connect private local area networks (LAN) to the internet or load balance servers.
Turn on IP forwarding to allow Linux computer to act as a gateway or router. echo 1 > /proc/sys/net/ipv4/ip_forward Default is 0. One can add firewall rules by using ipchains.
Another method is to alter the Linux kernel config file: /etc/sysctl.conf Set the following value:
net.ipv4.ip_forward = 1
See file /etc/sysconfig/network for storing this configuration.
FORWARD_IPV4=true Change the default "false" to "true".
All methods will result in a proc file value of "1". Test: cat /proc/sys/net/ipv4/ip_forward
The TCP Man page - Linux Programmer's Manual and /usr/src/linux/Documentation/proc.txt (Kernel 2.2 RH 7.0-) cover /proc/sys/net/ipv4/* file descriptions.
Alos see: (YoLinux tutorials)
Configure Linux as an internet gateway router: Using Linux and iptables/ipchains to set up an internet gateway for home or office (iptables)
Load balancing servers using LVS (Linux Virtual Server) (ipvsadm)
Adding a network interface card (NIC):
Manual method: This does not alter the permanent configuration and will only configure support until the next reboot.
cd /lib/modules/2.2.5-15/net/ - Use kernel version for your system. This example uses 2.2.5-15 (Fedora Core 3: /lib/modules/2.6.12-1.1381_FC3/kernel/net/) Here you will find the modules supported by your system. It can be permanently added to:
/etc/modprobe.conf (kernel 2.6)
/etc/modules.conf (kernel 2.4)
(or for older systems: /etc/conf.modules) Example: alias eth0 3c59x
/sbin/insmod 3c59x (For a 3Com ethernet card) This inserts the specified module into the kernel.
/sbin/modprobe 3c59x This also loads a module into the system kernel. Modprobe command line options:
-r : to unload the module.
/sbin/modprobe -l \* : list all modules.
/sbin/modprobe -lt net \* : List only network modules
/sbin/modprobe -t net \* : Try loading all network modules and see what sticks. (act of desperation)
ifconfig ...
The easy way: Red Hat versions 6.2 and later, ship with Kudzu, a device detection program which runs during system initialization. (/etc/rc.d/init.d/kudzu) This can detect a newly installed NIC and load the appropriate driver. Then use /usr/sbin/netconfig to configure the IP address and network settings. The configuration will be stored so that it will be utilized upon system boot.
Systems with two NIC cards: Typically two cards are used when connecting to two networks. In this case the device must be defined using one of three methods:
Use the Red Hat GUI tool /usr/bin/netcfg
OR
Define network parameters in configuration files:
Define new device in file (Red Hat/Fedora) /etc/sysconfig/network-scripts/ifcfg-eth1 (S.u.s.e 9.2: /etc/sysconfig/network/ifcfg-eth-id-XX:XX:XX:XX:XX)
DEVICE=eth1BOOTPROTO=staticIPADDR=192.168.10.12NETMASK=255.255.255.0GATEWAY=XXX.XXX.XXX.XXX
HOSTNAME=node-name.name-of-domain.com
DOMAIN=name-of-domain.com
Special routing information may be specified, if necessary, in the file (Red Hat/Fedora): /etc/sysconfig/static-routes (S.u.s.e. 9.2: /etc/sysconfig/network/routes)
Example:
eth1 net XXX.XXX.XXX.0 netmask 255.255.255.0 gw XXX.XXX.XXX.XXX
OR
Define network parameters using Unix command line interface:
Define IP address: ifconfig eth0 XXX.XXX.XXX.XXX netmask 255.255.255.0 broadcast XXX.XXX.XXX.255 ifconfig eth1 192.168.10.12 netmask 255.255.255.0 broadcast 192.168.10.255
If necessary, define route with with the route command: Examples: route add default gw XXX.XXX.XXX.XXX dev eth0 route add -net XXX.XXX.XXX.0 netmask 255.255.255.0 gw XXX.XXX.XXX.XXX dev eth0 Where XXX.XXX.XXX.XXX is the gateway to the internet as defined by your ISP or network operator.
If a mistake is made just repeat the route command substituting "del" in place of "add".
Configuring your NIC: Speed and Duplex settings:
This is usually not necessary because most ethernet adapters can auto-negotiate link speed and duplex setting.
List NIC speed and configuration: mii-tool eth0: negotiated 100baseTx-FD flow-control, link ok
Verbose mode: mii-tool -v
eth0: negotiated 100baseTx-FD flow-control, link ok product info: Intel 82555 rev 4 basic mode: autonegotiation enabled basic status: autonegotiation complete, link ok capabilities: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD advertising: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD flow-control link partner: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD flow-control
Set NIC configuration: mii-tool -F option
Option
Parameters
-F
100baseTx-FD100baseTx-HD10baseT-FD10baseT-HD
-A
100baseT4100baseTx-FD100baseTx-HD10baseT-FD10baseT-HD
Query NIC with ethtool:
Command
Description
ethtool -g eth0
Queries ethernet device for rx/tx ring parameter information.
ethtool -a eth0
Queries ethernet device for pause parameter information.
ethtool -c eth0
Queries ethernet device for coalescing information.
ethtool -i eth0
Queries ethernet device for associated driver information.
ethtool -d eth0
Prints a register dump for the specified ethernet device.
ethtool -k eth0
Queries ethernet device for offload information.
ethtool -S eth0
Queries ethernet device for NIC and driver statistics.
Man Pages:
mii-tool - view, manipulate media-independent interface status
ethtool - Display or change ethernet card settings
Route:
Static routes: IP (Internet Protocol) uses a routing table to determine where packets should be sent. First the packet is examined to see if its' destination is for the local or remote network. If it is to be sent to a remote network, the routing table is consulted to determine the path. If there is no information in the routing table then the packet is sent to the default gateway. Static routes are set with the route command and with the configuration file (Red Hat/Fedora): /etc/sysconfig/network-scripts/route-eth0 or (Red Hat 7: /etc/sysconfig/static-routes) (S.u.s.e. 9.2: /etc/sysconfig/network/routes):
10.2.3.0/16 via 192.168.10.254See command: /etc/sysconfig/network-scripts/ifup-routes eth0
Dynamic routes: RIP (Routing Information Protocol) is used to define dynamic routes. If multiple routes are possible, RIP will choose the shortest route. (Fewest hops between routers not physical distance.) Routers use RIP to broadcast the routing table over UDP port 520. The routers would then add new or improved routes to their routing tables.
Man pages:
route - show / manipulate the IP routing table (Static route) Examples:
Show routing table: route -e
Access individual computer host specified via network interface card eth1: route add -host 123.213.221.231 eth1
Access ISP network identified by the network address and netmask using network interface card eth0: route add -net 10.13.21.0 netmask 255.255.255.0 gw 192.168.10.254 eth0 Conversly: route del -net 10.13.21.0 netmask 255.255.255.0 gw 192.168.10.254 eth0
Specify default gateway to use to access remote network via network interface card eth0: route add default gw 201.51.31.1 eth0 (Gateway can also be defined in /etc/sysconfig/network)
Specify two gateways for two network destinations: (i.e. one external, one internal private network. Two routers/gateways will be specified.) Add internet gateway as before: route add default gw 201.51.31.1 eth0 Add second private network: route add -net 10.0.0.0 netmask 255.0.0.0 gw 192.168.10.254 eth0
routed - network routing daemon. Uses RIP protocol to update routing table.
ipx_route - show / manipulate the IPX routing table - IPX is the Novell networking protocol (Not typically used unless your office has Novell servers)
ifuser - Identify destinations routed to a particular network interface.
VPN, Tunneling:
Commercial VPN Linux software solutions - YoLinux
OpenVPN - SSL VPN solution for site to site, WiFi security, and enterprise-scale remote access with load balancing, failover, and fine-grained access-controls.
CIPE: Crypto IP Encapsulation (Easiest way to configure two Linux gateways connecting two private networks over the internet with encryption.)
CIPE Home page - CIPE is a simple encapsulation system that securely connects two subnets.
The Linux Cipe+Masquerading mini-HOWTO - Anthony Ciaravalo
Freeswan IPSec - An IPSec project for Linux (known as Freeswan and KLIPS).
GRE Tunneling - Hugo Samayoa
VPN HowTo - Matthew D. Wilson
Linux VPN support - PPTP, L2TP, ppp over SSH tunnel, VPN support working with 128-bit rc4 encryption. By Michael Elkins
Installing and Running PPTP on Linux
L2TP Extensions (l2tpext) Internet Drafts.
Description of the CISCO VPN at Cal Tech - Supports Linux (kernel 2.2), Solaris, MS/Windows 95/98/ME/NT/2000, Mac OS X/7.6-9.x
Usefull Linux networking commands:
/etc/rc.d/init.d/network start - command to start, restart or stop the network
netstat - Display connections, routing tables, stats etc
List externally connected processes: netstat -punta
List all connected processes: netstat -nap
Show network statistics: netstat -s
Kernel interface table info: netstat -a -i eth0
ping - send ICMP ECHO_REQUEST packets to network hosts. Use Cntl-C to stop ping.
traceroute - print the route packets take to network host
traceroute IP-address-of-server
traceroute domain-name-of-server
mtr - a network diagnostic tool introduced in Fedora - Like traceroute except it gives more network quality and network diagnostic info. Leave running to get real time stats. Reports best and worst round trip times in milliseconds.
mtr IP-address-of-server
mtr domain-name-of-server
whois - Lookup a domain name in the internic whois database.
finger - Display information on a system user. i.e. finger user@host Uses $HOME/.plan and $HOME/.project user files. Often used by game developers. See http://finger.planetquake.com/
iptables - IP firewall administration (Linux kernel 2.6/2.4) See YoLinux firewall/gateway configuration.
ipchains - IP firewall administration (Linux kernel 2.2) See YoLinux firewall/gateway configuration.
socklist - Display list of open sockets, type, port, process id and the name of the process. Kill with fuser or kill.
host - Give a host name and the command will return IP address. Unlike nslookup, the host command will use both /etc/hosts as well as DNS. Example: host domain-name-of-server
nslookup - Give a host name and the command will return IP address. Also see Testing your DNS (YoLinux Tutorial) Note that nslookup does not use the /etc/hosts file.
inetd/xinetd: Network Socket Listener Daemons:
The network listening daemons listen and respond to all network socket connections made on the TCP/IP ports assigned to it. The ports are defined by the file /etc/services. When a connection is made, the listener will attempt to invoke the assigned program and pipe the data to it. This simplified matters by allowing the assigned program to read from stdin instead of making its own sockets connection. The listener hadles the network socket connection. Two network listening and management daemons have been used in Red Hat Linux distributions:
inetd: Red Hat 6.x and older
xinetd: Red Hat 7.0-9.0, Fedora Core
inetd:
Configuration file: /etc/inetd.conf Entries in this file consist of a single line made up of the following fields: service socket-type protocol wait user server cmdline
service: The name assigned to the service. Matches the name given in the file /etc/services
socket-type:
stream: connection protocols (TCP)
dgram: datagram protocols (UDP)
raw
rdm
seqpacket
protocol: Transport protocol name which matches a name in the file /etc/protocols. i.e. udp, icmp, tcp, rpc/udp, rpc/tcp, ip, ipv6
wait: Applies only to datagram protocols (UDP).
wait[.max]: One server for the specified port at any time (RPC)
nowait[.max]: Continue to listen and launch new services if a new connection is made. (multi-threaded) Max refers to the maximum number of server instances spawned in 60 seconds. (default=40)
user[.group]: login id of the user the process is executed under. Often nobody, root or a special restricted id for that service.
server: Full path name of the server program to be executed.
cmdline: Command line to be passed to the server. This includes argument 0 (argv[0]), that is the command name. This field is empty for internal services. Example of internal TCP services: echo, discard, chargen (character generator), daytime (human readable time), and time (machine readable time). (see RFC)
Sample File: /etc/inetd.conf
#echo stream tcp nowait root internal#echo dgram udp wait root internalftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a#pop-3 stream tcp nowait root /usr/sbin/tcpd ipop3d#swat stream tcp nowait.400 root /usr/sbin/swat swatA line may be commented out by using a '#' as the first character in the line. This will turn the service off. The maximum length of a line is 1022 characters.
The inet daemon must be restarted to pick up the changes made to the file: /etc/rc.d/init.d/inetd restart
For more information see the man pages "inetd" and "inetd.conf".
Some addresses are reserved and outside this scope. Loopback (127.0.0.1), reserved class C 192.168.XXX.XXX, reserved class B 172.31.XXX.XXX and reserved class A 10.XXX.XXX.XXX.
Subnet Example:
Your ISP assigns you a subnet mask of 255.255.255.248 for your office.
208.88.34.104 Network Base address
208.88.34.105 Computer 1
208.88.34.106 Computer 2
208.88.34.107 Computer 3
208.88.34.108 Computer 4
208.88.34.109 Computer 5
208.88.34.110 DSL router/Gateway
208.88.34.111 Broadcast address Of the eight addresses, there are six assigned to hardware systems and ultimately only five usable addresses.
Links:
Subnet Cheat Sheet
Subnet calculator
Table of subnets
IP Subnetting, Variable Subnetting, and CIDR (Supernetting)
CISCO.com: Subnet Masking and Addressing
Network Classes:
The concept of network classes is a little obsolete as subnets are now used to define smaller networks. These subnets may be part of a class A, B, C, etc network. For historical reference the network classes are defined as follows:
Class A: Defined by the first 8 bits with a range of 0 - 127. First number (8 bits) is defined by Internic i.e. 77.XXX.XXX.XXX One class A network can define 16,777,214 hosts. Range: 0.0.0.0 - 127.255.255.255
Class B: Defined by the first 8 bits with a range from 128 - 191 First two numbers (16 bits) are defined by Internic i.e. 182.56.XXX.XXX One class B network can define 65,534 hosts. Range: 128.0.0.0 - 191.255.255.255
Class C: Defined by the first 8 bits with a range from 192 - 223 First three numbers (24 bits) are defined by Internic i.e. 220.56.222.XXX One class B network can define 254 hosts. Range: 192.0.0.0 - 223.255.255.255
Class D: Defined by the first 8 bits with a range from 224 - 239 This is reserved for multicast networks (RFC988) Range: 224.0.0.0 - 239.255.255.255
Class E: Defined by the first 8 bits with a range from 240 - 255 This is reserved for experimental use. Range: 240.0.0.0 - 247.255.255.255
Enable Forwarding:Forwarding allows the network packets on one network interface (i.e. eth0) to be forwarded to another network interface (i.e. eth1). This will allow the Linux computer to conect ("ethernet bridge") or route network traffic.
The bridge configuration will merge two (or several) networks into one single network topology. IpTables firewall rules can be used to filter traffic.
A router configuration can support multicast and basic IP routing using the "route" command. IP masquerading (NAT) can be used to connect private local area networks (LAN) to the internet or load balance servers.
Turn on IP forwarding to allow Linux computer to act as a gateway or router. echo 1 > /proc/sys/net/ipv4/ip_forward Default is 0. One can add firewall rules by using ipchains.
Another method is to alter the Linux kernel config file: /etc/sysctl.conf Set the following value:
net.ipv4.ip_forward = 1
See file /etc/sysconfig/network for storing this configuration.
FORWARD_IPV4=true Change the default "false" to "true".
All methods will result in a proc file value of "1". Test: cat /proc/sys/net/ipv4/ip_forward
The TCP Man page - Linux Programmer's Manual and /usr/src/linux/Documentation/proc.txt (Kernel 2.2 RH 7.0-) cover /proc/sys/net/ipv4/* file descriptions.
Alos see: (YoLinux tutorials)
Configure Linux as an internet gateway router: Using Linux and iptables/ipchains to set up an internet gateway for home or office (iptables)
Load balancing servers using LVS (Linux Virtual Server) (ipvsadm)
Adding a network interface card (NIC):
Manual method: This does not alter the permanent configuration and will only configure support until the next reboot.
cd /lib/modules/2.2.5-15/net/ - Use kernel version for your system. This example uses 2.2.5-15 (Fedora Core 3: /lib/modules/2.6.12-1.1381_FC3/kernel/net/) Here you will find the modules supported by your system. It can be permanently added to:
/etc/modprobe.conf (kernel 2.6)
/etc/modules.conf (kernel 2.4)
(or for older systems: /etc/conf.modules) Example: alias eth0 3c59x
/sbin/insmod 3c59x (For a 3Com ethernet card) This inserts the specified module into the kernel.
/sbin/modprobe 3c59x This also loads a module into the system kernel. Modprobe command line options:
-r : to unload the module.
/sbin/modprobe -l \* : list all modules.
/sbin/modprobe -lt net \* : List only network modules
/sbin/modprobe -t net \* : Try loading all network modules and see what sticks. (act of desperation)
ifconfig ...
The easy way: Red Hat versions 6.2 and later, ship with Kudzu, a device detection program which runs during system initialization. (/etc/rc.d/init.d/kudzu) This can detect a newly installed NIC and load the appropriate driver. Then use /usr/sbin/netconfig to configure the IP address and network settings. The configuration will be stored so that it will be utilized upon system boot.
Systems with two NIC cards: Typically two cards are used when connecting to two networks. In this case the device must be defined using one of three methods:
Use the Red Hat GUI tool /usr/bin/netcfg
OR
Define network parameters in configuration files:
Define new device in file (Red Hat/Fedora) /etc/sysconfig/network-scripts/ifcfg-eth1 (S.u.s.e 9.2: /etc/sysconfig/network/ifcfg-eth-id-XX:XX:XX:XX:XX)
DEVICE=eth1BOOTPROTO=staticIPADDR=192.168.10.12NETMASK=255.255.255.0GATEWAY=XXX.XXX.XXX.XXX
HOSTNAME=node-name.name-of-domain.com
DOMAIN=name-of-domain.com
Special routing information may be specified, if necessary, in the file (Red Hat/Fedora): /etc/sysconfig/static-routes (S.u.s.e. 9.2: /etc/sysconfig/network/routes)
Example:
eth1 net XXX.XXX.XXX.0 netmask 255.255.255.0 gw XXX.XXX.XXX.XXX
OR
Define network parameters using Unix command line interface:
Define IP address: ifconfig eth0 XXX.XXX.XXX.XXX netmask 255.255.255.0 broadcast XXX.XXX.XXX.255 ifconfig eth1 192.168.10.12 netmask 255.255.255.0 broadcast 192.168.10.255
If necessary, define route with with the route command: Examples: route add default gw XXX.XXX.XXX.XXX dev eth0 route add -net XXX.XXX.XXX.0 netmask 255.255.255.0 gw XXX.XXX.XXX.XXX dev eth0 Where XXX.XXX.XXX.XXX is the gateway to the internet as defined by your ISP or network operator.
If a mistake is made just repeat the route command substituting "del" in place of "add".
Configuring your NIC: Speed and Duplex settings:
This is usually not necessary because most ethernet adapters can auto-negotiate link speed and duplex setting.
List NIC speed and configuration: mii-tool eth0: negotiated 100baseTx-FD flow-control, link ok
Verbose mode: mii-tool -v
eth0: negotiated 100baseTx-FD flow-control, link ok product info: Intel 82555 rev 4 basic mode: autonegotiation enabled basic status: autonegotiation complete, link ok capabilities: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD advertising: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD flow-control link partner: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD flow-control
Set NIC configuration: mii-tool -F option
Option
Parameters
-F
100baseTx-FD100baseTx-HD10baseT-FD10baseT-HD
-A
100baseT4100baseTx-FD100baseTx-HD10baseT-FD10baseT-HD
Query NIC with ethtool:
Command
Description
ethtool -g eth0
Queries ethernet device for rx/tx ring parameter information.
ethtool -a eth0
Queries ethernet device for pause parameter information.
ethtool -c eth0
Queries ethernet device for coalescing information.
ethtool -i eth0
Queries ethernet device for associated driver information.
ethtool -d eth0
Prints a register dump for the specified ethernet device.
ethtool -k eth0
Queries ethernet device for offload information.
ethtool -S eth0
Queries ethernet device for NIC and driver statistics.
Man Pages:
mii-tool - view, manipulate media-independent interface status
ethtool - Display or change ethernet card settings
Route:
Static routes: IP (Internet Protocol) uses a routing table to determine where packets should be sent. First the packet is examined to see if its' destination is for the local or remote network. If it is to be sent to a remote network, the routing table is consulted to determine the path. If there is no information in the routing table then the packet is sent to the default gateway. Static routes are set with the route command and with the configuration file (Red Hat/Fedora): /etc/sysconfig/network-scripts/route-eth0 or (Red Hat 7: /etc/sysconfig/static-routes) (S.u.s.e. 9.2: /etc/sysconfig/network/routes):
10.2.3.0/16 via 192.168.10.254See command: /etc/sysconfig/network-scripts/ifup-routes eth0
Dynamic routes: RIP (Routing Information Protocol) is used to define dynamic routes. If multiple routes are possible, RIP will choose the shortest route. (Fewest hops between routers not physical distance.) Routers use RIP to broadcast the routing table over UDP port 520. The routers would then add new or improved routes to their routing tables.
Man pages:
route - show / manipulate the IP routing table (Static route) Examples:
Show routing table: route -e
Access individual computer host specified via network interface card eth1: route add -host 123.213.221.231 eth1
Access ISP network identified by the network address and netmask using network interface card eth0: route add -net 10.13.21.0 netmask 255.255.255.0 gw 192.168.10.254 eth0 Conversly: route del -net 10.13.21.0 netmask 255.255.255.0 gw 192.168.10.254 eth0
Specify default gateway to use to access remote network via network interface card eth0: route add default gw 201.51.31.1 eth0 (Gateway can also be defined in /etc/sysconfig/network)
Specify two gateways for two network destinations: (i.e. one external, one internal private network. Two routers/gateways will be specified.) Add internet gateway as before: route add default gw 201.51.31.1 eth0 Add second private network: route add -net 10.0.0.0 netmask 255.0.0.0 gw 192.168.10.254 eth0
routed - network routing daemon. Uses RIP protocol to update routing table.
ipx_route - show / manipulate the IPX routing table - IPX is the Novell networking protocol (Not typically used unless your office has Novell servers)
ifuser - Identify destinations routed to a particular network interface.
VPN, Tunneling:
Commercial VPN Linux software solutions - YoLinux
OpenVPN - SSL VPN solution for site to site, WiFi security, and enterprise-scale remote access with load balancing, failover, and fine-grained access-controls.
CIPE: Crypto IP Encapsulation (Easiest way to configure two Linux gateways connecting two private networks over the internet with encryption.)
CIPE Home page - CIPE is a simple encapsulation system that securely connects two subnets.
The Linux Cipe+Masquerading mini-HOWTO - Anthony Ciaravalo
Freeswan IPSec - An IPSec project for Linux (known as Freeswan and KLIPS).
GRE Tunneling - Hugo Samayoa
VPN HowTo - Matthew D. Wilson
Linux VPN support - PPTP, L2TP, ppp over SSH tunnel, VPN support working with 128-bit rc4 encryption. By Michael Elkins
Installing and Running PPTP on Linux
L2TP Extensions (l2tpext) Internet Drafts.
Description of the CISCO VPN at Cal Tech - Supports Linux (kernel 2.2), Solaris, MS/Windows 95/98/ME/NT/2000, Mac OS X/7.6-9.x
Usefull Linux networking commands:
/etc/rc.d/init.d/network start - command to start, restart or stop the network
netstat - Display connections, routing tables, stats etc
List externally connected processes: netstat -punta
List all connected processes: netstat -nap
Show network statistics: netstat -s
Kernel interface table info: netstat -a -i eth0
ping - send ICMP ECHO_REQUEST packets to network hosts. Use Cntl-C to stop ping.
traceroute - print the route packets take to network host
traceroute IP-address-of-server
traceroute domain-name-of-server
mtr - a network diagnostic tool introduced in Fedora - Like traceroute except it gives more network quality and network diagnostic info. Leave running to get real time stats. Reports best and worst round trip times in milliseconds.
mtr IP-address-of-server
mtr domain-name-of-server
whois - Lookup a domain name in the internic whois database.
finger - Display information on a system user. i.e. finger user@host Uses $HOME/.plan and $HOME/.project user files. Often used by game developers. See http://finger.planetquake.com/
iptables - IP firewall administration (Linux kernel 2.6/2.4) See YoLinux firewall/gateway configuration.
ipchains - IP firewall administration (Linux kernel 2.2) See YoLinux firewall/gateway configuration.
socklist - Display list of open sockets, type, port, process id and the name of the process. Kill with fuser or kill.
host - Give a host name and the command will return IP address. Unlike nslookup, the host command will use both /etc/hosts as well as DNS. Example: host domain-name-of-server
nslookup - Give a host name and the command will return IP address. Also see Testing your DNS (YoLinux Tutorial) Note that nslookup does not use the /etc/hosts file.
inetd/xinetd: Network Socket Listener Daemons:
The network listening daemons listen and respond to all network socket connections made on the TCP/IP ports assigned to it. The ports are defined by the file /etc/services. When a connection is made, the listener will attempt to invoke the assigned program and pipe the data to it. This simplified matters by allowing the assigned program to read from stdin instead of making its own sockets connection. The listener hadles the network socket connection. Two network listening and management daemons have been used in Red Hat Linux distributions:
inetd: Red Hat 6.x and older
xinetd: Red Hat 7.0-9.0, Fedora Core
inetd:
Configuration file: /etc/inetd.conf Entries in this file consist of a single line made up of the following fields: service socket-type protocol wait user server cmdline
service: The name assigned to the service. Matches the name given in the file /etc/services
socket-type:
stream: connection protocols (TCP)
dgram: datagram protocols (UDP)
raw
rdm
seqpacket
protocol: Transport protocol name which matches a name in the file /etc/protocols. i.e. udp, icmp, tcp, rpc/udp, rpc/tcp, ip, ipv6
wait: Applies only to datagram protocols (UDP).
wait[.max]: One server for the specified port at any time (RPC)
nowait[.max]: Continue to listen and launch new services if a new connection is made. (multi-threaded) Max refers to the maximum number of server instances spawned in 60 seconds. (default=40)
user[.group]: login id of the user the process is executed under. Often nobody, root or a special restricted id for that service.
server: Full path name of the server program to be executed.
cmdline: Command line to be passed to the server. This includes argument 0 (argv[0]), that is the command name. This field is empty for internal services. Example of internal TCP services: echo, discard, chargen (character generator), daytime (human readable time), and time (machine readable time). (see RFC)
Sample File: /etc/inetd.conf
#echo stream tcp nowait root internal#echo dgram udp wait root internalftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a#pop-3 stream tcp nowait root /usr/sbin/tcpd ipop3d#swat stream tcp nowait.400 root /usr/sbin/swat swatA line may be commented out by using a '#' as the first character in the line. This will turn the service off. The maximum length of a line is 1022 characters.
The inet daemon must be restarted to pick up the changes made to the file: /etc/rc.d/init.d/inetd restart
For more information see the man pages "inetd" and "inetd.conf".
Network Definitions:
IPv4: Most of the Internet servers and personal computers use Internet Protocol version 4 (IPv4). This uses 32 bits to assign a network address as defined by the four octets of an IP address up to 255.255.255.255. Which is the representation of four 8 bit numbers thus totaling 32 bits.
IPv6: Internet Protocol version 6 (IPv6) uses a 128 bit address and thus billions and billions of potential addresses. The protocol has also been upgraded to include new quality of service features and security. Currently Linux supports IPv6 but IPv4 is used when connecting your computer to the internet.
TCP/IP: (Transmission Control Protocol/Internet Protocol) uses a client - server model for communications. The protocol defines the data packets transmitted (packet header, data section), data integrity verification (error detection bytes), connection and acknowledgement protocol, and re-transmission.
TCP/IP time to live (TTL): This is a counting mechanism to determine how long a packet is valid before it reaches its destination. Each time a TCP/IP packet passes through a router it will decrement its TTL count. When the count reaches zero the packet is dropped by the router. This ensures that errant routing and looping aimless packets will not flood the network.
MAC Address: (media access control) is the network card address used for communication between other network devices on the subnet. This info is not routable. The ARP table maps TCP/IP address (global internet) to the local hardware on the local network. Use the command /sbin/ifconfig to view both the IP address and the MAC address. The MAC address uniquely identifies each node of a network and is used by the Ethernet protocol.
Full Duplex: Allows the simultaneous sending and receiving of packets. Most modern modems support full duplex.
Half Duplex: Allows the sending and receiving of packets in one direction at a time only.
OSI 7 Layer Model: The ISO (International Standards Organization) has defined the OSI (Open Systems Interconnection) model for current networking protocols.
OSI Layer
Description
Linux Networking Use 7
Application Layer.The top layer for communications applications like email and the web.
telnet, web browser, sendmail 6
Presentation Layer.Syntax and format of data transfer.
SMTP, http 5
Session Layer. 4
Transport Layer.Connection, acknowledgement and data packet transmission.
TCPUDP 3
Network Layer.
IPARP 2
Data Link Layer.Error control, timing
Ethernet 1
Physical Layer.Electrical characteristics of signal and NIC
Ethernet
Network Hub: Hardware to connect network devices together. The devices will all be on the same network and/or subnet. All network traffic is shared and can be sniffed by any other node connected to the same hub.
Network Switch: Like a hub but creates a private link between any two connected nodes when a network connection is established. This reduces the amount of network collisions and thus improves speed. Broadcast messages are still sent to all nodes.
0 komentar:
Post a Comment