Modern Linux configures networking through the ip suite, which supersedes the older ifconfig and route. ip addr show lists addresses and their interfaces, ip link show enumerates link-layer state, ip route show prints the routing table, ip addr add 10.0.0.5/24 dev eth0 attaches an address, ip link set eth0 up activates an interface, and ip neigh show exposes the ARP cache. Socket statistics are read with ss rather than the legacy netstat: ss -tuln shows TCP and UDP listeners with numeric ports, ss -tp adds owning processes, and ss -s prints a summary. To locate the process behind a specific port, ss -tulnp 'sport = :80', lsof -i :80, or fuser 80/tcp all work, with ss reading kernel data via netlink and being the fastest of the three.
For diagnostics, three small utilities cover most needs. ping -c 4 host measures reachability and round-trip latency, traceroute host lists the routers hops traverse on the way to the destination, and dig example.com queries DNS — dig +short condenses the answer, dig @8.8.8.8 example.com targets a specific resolver, and dig example.com MX selects mail records, while nslookup remains a simpler interactive alternative. DNS resolution order is dictated by /etc/nsswitch.conf (typically hosts: files dns), and configuration is recorded in /etc/resolv.conf with nameserver, search, and options lines. On systemd-equipped hosts, systemd-resolved often intercepts these calls: it listens on 127.0.0.53, may stub /etc/resolv.conf with a symlink, and provides resolvectl status, resolvectl query, and resolvectl dns eth0 8.8.8.8 for management. Split DNS is supported through the Domains=~internal setting in /etc/systemd/resolved.conf, which routes *.internal queries to a chosen upstream. Bridges and VLANs layer atop ip link: ip link add br0 type bridge builds a virtual switch, ip link set eth0 master br0 attaches an interface, and ip link add link eth0 name eth0.10 type vlan id 10 creates an 802.1Q-tagged subinterface — a building block when configuring VMs or containers. To turn a host into a router, enable net.ipv4.ip_forward=1 via sysctl, assign an interface per subnet, and add a masquerading NAT rule with nftables.
SSH is the de facto remote administration tool. A connection starts with ssh user@hostname (with -p 2222 if the daemon listens on a non-default port), but the recommended authentication path is public-key cryptography: ssh-keygen -t ed25519 generates a key pair, ssh-copy-id user@host installs the public key into the remote ~/.ssh/authorized_keys, and an entry in ~/.ssh/config can alias the host with its hostname, user, and identity file. The ssh-agent holds decrypted private keys in memory after ssh-add, and ssh -A forwards that agent, though forwarding to an untrusted bastion is risky — the safer alternative is the modern ProxyJump form ssh -J jumphost target (also writable in ~/.ssh/config). Common tunneling patterns include local port forwarding (ssh -L 8080:internal:80 bastion), remote forwarding (ssh -R 8080:localhost:80 bastion), and dynamic SOCKS proxies (ssh -D 1080 host). Host keys, generated at sshd startup and stored under /etc/ssh/ in ssh_host_ed25519_key, ssh_host_ecdsa_key, and ssh_host_rsa_key files, identify the server to the client; a change triggers a man-in-the-middle warning, cleared with ssh-keygen -R hostname on the client.
Hardening sshd begins in /etc/ssh/sshd_config and finishes with systemctl restart sshd. PermitRootLogin no, PasswordAuthentication no, PubkeyAuthentication yes, AllowUsers alice bob or AllowGroups sshusers, MaxAuthTries 3, LoginGraceTime 30, and a non-default Port 2222 are typical. Idle sessions can be cut off with ClientAliveInterval 300 and ClientAliveCountMax 2; AllowTcpForwarding no and X11Forwarding no close off features that aren't needed; sshd -t validates the configuration safely. To protect against brute force, fail2ban scans logs (typically /var/log/auth.log or /var/log/nginx/error.log) and bans offending IPs at the firewall; configuration lives in /etc/fail2ban/jail.local, with enabled = true, maxretry = 3, findtime = 600, and bantime = 3600, and operations are performed through fail2ban-client status, ... status sshd, and unban <ip>.
The firewall itself is nftables on modern Linux, with two friendly front ends. nft builds a ruleset as tables and chains: nft add table inet filter plus an input chain with policy drop creates a default-deny posture, while selective accepts loopback traffic, ct state established,related connections, and chosen ports (e.g., tcp dport 22 accept); nft list ruleset > /etc/nftables.conf persists the configuration, and enabling nftables.service ensures it survives reboots. Ubuntu ships ufw as a simpler layer, with ufw allow 22/tcp, ufw default deny incoming, and ufw enable for the common cases; rules land in /etc/ufw/. RHEL provides firewalld, which organizes the firewall around zones (public, internal, dmz, trusted, block, drop) assigned to interfaces, with commands like firewall-cmd --zone=public --add-port=80/tcp --permanent and --reload for runtime change vs persistent storage. For deeper inspection, tcpdump -i eth0 -nn -w cap.pcap captures raw packets — viewable in Wireshark — and openssl s_client -connect host:443 -servername host examines TLS handshakes, which depend on certificates issued by certbot --nginx -d example.com from Let's Encrypt and stored under /etc/letsencrypt/live/.
File transfers over SSH prefer rsync over scp because rsync only sends changed blocks, supports resumes, and handles complex flags efficiently. The canonical form rsync -avz -e ssh /src/ user@host:/dst/ walks /src/, preserves permissions and timestamps, and compresses during transit; --progress shows a status line, --delete mirrors deletions from the destination, --exclude='*.tmp' filters patterns, --dry-run previews actions, and --bwlimit=5000 caps bandwidth in KB/s. --link-dest=/prev enables hard-link snapshot backups by referring unchanged files to a previous run. The trailing slash on the source matters: /src/ copies directory contents while /src copies the directory itself. By contrast, scp file user@host:/path/ (or scp -r dir/ user@host:/path/) performs straightforward secure copies without delta logic. For purely outbound downloads, curl -O URL supports a wide range of protocols and HTTP verbs (curl -X POST -d '...' URL, curl -I URL for headers), while wget -r URL specializes in recursive, resuable, mirror-style downloads (wget -c URL resumes a partial file).