Modern Linux networking is configured with the ip family of commands. ip addr shows interfaces with their addresses and state; ip addr add IP/PREFIX dev IFACE assigns one, ip addr del removes a specific address, and ip addr flush dev IFACE removes all. ip link shows link state, while ip link set dev eth0 up or down enables or disables an interface, and ip link set dev eth0 mtu 9000 sets the MTU (with 9000 enabling jumbo frames). Interface error and drop counters are listed with ip -s link. The routing table is inspected with ip route (or the legacy netstat -rn), static routes added with ip route add NETWORK via GATEWAY dev IFACE and removed with ip route del. ip route get DEST shows which interface and source IP will be used. The neighbor table (ARP for IPv4, NDP for IPv6) is shown with ip neigh and flushed with ip neigh flush dev IFACE or ip neigh flush all. Interface details including link speed, duplex, and driver info come from ethtool eth0, with autonegotiation forced via ethtool -s eth0 autoneg off speed 1000 duplex full.
Higher-level network configuration varies by distribution. Ubuntu's Netplan stores YAML in /etc/netplan/, applied with netplan apply. Debian's classic /etc/network/interfaces remains in use on some systems. NetworkManager, common on desktops, is driven by nmcli: nmcli connection show lists profiles, nmcli connection up "name" activates one, nmcli device status shows devices, and nmcli connection modify "name" ipv4.addresses IP/PREFIX ipv4.gateway GW ipv4.method manual sets a static address. systemd-networkd is a lean alternative. Virtual constructs include VLANs (ip link add link eth0 name eth0.100 type vlan id 100), bonding or teaming for failover or bandwidth aggregation, and bridges (ip link add br0 type bridge plus ip link set eth0 master br0); brctl is the legacy bridge tool now superseded. The loopback interface lo carries IP 127.0.0.1 for local-only communication.
Firewall management in Linux offers several layers. iptables -L -n -v lists rules with counters and no DNS resolution; rules based on the recent match module enable rate-limiting SSH via iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set. nftables is the modern unified replacement, with nft list ruleset dumping all current rules. Ubuntu's ufw allow 22/tcp creates a high-level rule to permit SSH, while ufw provides additional rule management. fail2ban watches logs and dynamically updates firewall rules to block brute-force attempts. Port knocking is another defense, requiring a specific sequence of connection attempts before opening ports. For listening ports, ss -tlnp shows TCP listeners with process names and PIDs, ss -tan state established filters established connections, ss -s summarizes protocol counts, and ss -tulpn includes UDP sockets. lsof -i :PORT finds the process on a given port, as does fuser -v 80/tcp, and lsof +D /path enumerates open files under a directory (useful for spotting deleted files still held open by processes).
Connectivity diagnostics start with ping -c 4 host for basic reachability. traceroute shows the network path; tracepath does the same without root and discovers MTU along the way. mtr -rw host runs a report-mode traceroute with packet loss and latency. Port reachability can be tested with nc -zv host 443 (and nc -l 8080 listens and prints received data). Without netcat, timeout 3 bash -c 'cat < /dev/null > /dev/tcp/host/port' && echo open works using bash's built-in TCP. nmap -sT -p 80,443 host performs a TCP connect scan on selected ports, and nmap -p- scans all 65535 ports. tcpdump -i IFACE port 80 captures packets live, -w capture.pcap writes them to a file for later analysis with tcpdump -nn -r capture.pcap. curl -I https://host fetches only HTTP headers, curl -L follows redirects, curl -X POST -H "Content-Type: application/json" -d '{"key":"value"}' sends JSON, and openssl s_client -connect host:443 -servername host shows TLS certificate details for the negotiated host. wget -r -l 2 downloads recursively with depth limits and wget -c resumes partial downloads. /etc/services maps service names to port numbers, and /etc/protocols maps protocol names to numbers.