Networking on Linux

This chapter follows Linux security primitives.

TCP, UDP, IP addressing, and routing concepts apply on every platform—see Networking concepts and protocols and IP routing. This chapter is what changes on a Linux host: how interfaces appear, which tools configure them, how name resolution is wired, and where netfilter filters packets.

The kernel network stack

Applications use sockets; the kernel handles routing, neighbor discovery (ARP/NDP), and queuing. ss (from iproute2) replaces much of legacy netstat:

1
ss -tulpn
2
ip link show
3
ip addr show
4
ip route show

Network namespaces (used by containers) duplicate the stack—each namespace has its own interfaces and routing table. Docker networking builds bridges and veth pairs on top.

Diagram 1

flowchart TB
  app[Application]
  socket[socket API]
  stack[TCP UDP IP]
  driver[NIC driver]
  nft[netfilter nftables]
  app --> socket --> stack --> nft --> driver

Interface naming and link management

Predictable names such as enp0s31f6 come from udev rules instead of fragile eth0 ordering. ip link set dev eth0 up (with the actual name) administers links; ethtool inspects driver and link settings.

Legacy ifconfig/ifupdown still appear in docs; Debian desktop and server images may use NetworkManager, minimal servers systemd-networkd, or ifupdown via /etc/network/interfaces. Know which owns your machine before editing the wrong files.

Configuring addresses and routes

iproute2 commands manipulate addresses, routes, and rules:

1
sudo ip addr add 192.0.2.10/24 dev enp0s31f6
2
sudo ip route add default via 192.0.2.1

Persistent config lives in NetworkManager keyfiles, /etc/systemd/network/, or /etc/network/interfaces depending on stack. Cloud images often inject config via metadata at boot.

Name resolution on Debian

Order of lookup is controlled by /etc/nsswitch.conf (hosts: line). Sources include /etc/hosts, DNS, and sometimes systemd-resolved.

/etc/resolv.conf may be a symlink to /run/systemd/resolve/stub-resolv.conf when resolved manages DNS. resolvectl status shows per-link DNS servers.

Misconfigured resolution looks like “ping works by IP but curl fails by name”—check nsswitch and resolv.conf before firewall rules.

netfilter and nftables

netfilter hooks in the kernel filter, NAT, and mangle packets. nftables is the modern userland interface (replacing iptables on many Debian installs):

1
sudo nft list ruleset

Docker and Kubernetes insert rules for published ports and service routing—coordinate custom nftables rules to avoid clobbering chains managed by runtimes.

Host firewalling complements SSH hardening and application auth; HTTP-specific threats are covered under Open Standards and Concepts web security articles when published.

Bridges, veth, and container paths

Linux bridges (ip link add type bridge) connect namespaces and VMs. veth pairs pipe one end in a container namespace, one on the host—default Docker bridge networking.

Tunnels (WireGuard, IPsec) also terminate in the kernel; generic tunnel concepts appear in Network Tunneling.

User-facing terminals and the graphical stack are next—Terminals and shells in Linux and Graphical desktops on Linux.

The next chapter is Terminals and shells in Linux.