Chapter Nine
Networking
How a packet moves from the wire to a process, how you configure and persist addressing and routes, and the four tools you reach for when someone says "the network is down."
Most "the network is broken" incidents are one of four things wearing a disguise: a DNS lookup failing, a missing or wrong route, a firewall dropping the packet, or a service bound to the wrong address. This chapter takes the path a packet travels — NIC, kernel stack, socket, process — and gives you the tool that isolates each layer, so you stop guessing and start localizing.
It leads with the modern iproute2 toolset (ip, ss) rather than the deprecated net-tools (ifconfig, netstat), and with the Debian/Ubuntu configuration backends — Netplan, systemd-networkd, systemd-resolved, ufw, and nftables — noting the Red Hat equivalents where they diverge. By the end you can configure an interface that survives a reboot, read a routing table, see exactly what is listening and who owns it, build a default-deny firewall without locking yourself out, and run SSH the way a server admin should.
Topics in This Chapter
iproute2 replaced net-tools.ip, CIDR fluency, and static versus DHCP on a server. The part that bites is persistence — Netplan, systemd-networkd, or NetworkManager, not a runtime-only ip addr add that vanishes on reboot.ip route get shows the route it will pick; traceroute and mtr show the actual hop-by-hop path when one fails.nsswitch.conf, /etc/hosts, /etc/resolv.conf, and the local 127.0.0.53 stub. The classic trap: hand-editing a resolv.conf that systemd-resolved owns as a symlink and overwrites on the next event.ss -tlnp shows what is listening and which process owns it. The single most common "works locally, not remotely" cause is a service bound to 127.0.0.1 instead of 0.0.0.0.nftables is the modern front-end, iptables the one people still think in, and ufw/firewalld the wrappers. A host firewall is default-deny inbound with explicit allows — and the rules must survive reboot.~/.ssh/config with ProxyJump, and the agent right is the difference between frictionless and password-prompt-hell.