1. Understanding Network Interfaces
Before you can attack or defend a network, you need to know who you are on that network. Every device has network interfaces (virtual or physical cards).
eth0 / wlan0
Your physical connection. eth0 is usually wired, wlan0 is Wi-Fi.
lo (Loopback)
The "Home" address (127.0.0.1). Traffic sent here stays inside your computer.
🛡️ Security Mindset
Attackers first check ip a to see what subnet they are on. If they see multiple interfaces, the machine might be a bridge to another network.
2. IP Address & Routing
Having an IP is useless if your computer doesn't know where to send traffic. The Routing Table is the map your computer follows.
- Default via 192.168.1.1: This is your Gateway (usually your Router). If your computer doesn't know where an IP is, it sends it here.
- 192.168.1.0/24: This says "computers with these IPs are right next to me (Local LAN)."
✅ Quick Check
- What command shows the routing table? (Answer:
ip routeorroute -n) - If the "default" line is missing, can you reach the internet? (Answer: No)
3. Checking Connectivity (Ping)
The "Hello World" of networking. Ping sends an ICMP Echo Request. If the other computer is alive and willing, it sends a Reply.
Troubleshooting Logic
- Ping 127.0.0.1: Is my network card working?
- Ping 192.168.1.1 (Gateway): Am I connected to the router?
- Ping 8.8.8.8 (Google): Do I have internet?
- Ping google.com: Is my DNS working?
🛡️ Security Mindset
Firewalls often block ICMP (Ping) to hide servers. Just because a server doesn't ping, doesn't mean it's offline.
4. DNS Investigation
Computers speak numbers (IPs); humans speak names (google.com). Tools like nslookup and dig ask the DNS server for the IP address.
Common Record Types:
- A Record: The IPv4 address.
- MX Record: The Mail server (where emails go).
- AAAA Record: The IPv6 address.
During a security assessment, checking DNS records (Reconnaissance) is often the very first step to map out a target's infrastructure.
5. Port & Connection Analysis
If the IP is the house address, ports are the doors. You need to know which doors are open and what services are listening.
Use ss (Socket Statistics) or the legacy netstat.
-tuln Flags
t: TCP
u: UDP
l: Listening sockets only
n: Numeric (Show 80, not 'http')
Why it matters
If you see a port listening that you didn't install (like port 6667), you might have malware.
6. Tracing the Path
When you connect to a server, your packet hops through many routers. traceroute shows you every hop along the way.
It works by manipulating the TTL (Time To Live) of a packet. It intentionally causes the packet to "die" at hop 1, then hop 2, then hop 3, forcing each router to send back an error message identifying itself.
7. Packet Capture (Traffic Inspection)
Sometimes commands tell you everything looks fine, but it still doesn't work. This is when you use tcpdump to look at the actual raw data flying through the wire.
🛡️ Security Mindset
This is the "X-Ray" of networking. Security analysts use this to see exactly what malware is sending out, or why a firewall is dropping a connection.
8. Nmap Essentials
While ss checks your ports, nmap checks remote ports. It is the industry standard for network mapping and scanning.
⚠️ Warning
Scanning networks you do not own is illegal in many jurisdictions. Only scan your own labs or networks where you have explicit permission.
9. Real Troubleshooting Flow
Internet down? Don't guess. Follow the data path.
📌 Recap
- ip a: Show interfaces and IP.
- ip route: Show gateway and routing table.
- ping: Test connectivity (ICMP).
- ss -tuln: Check local listening ports.
- dig / nslookup: Query DNS records.
- tcpdump: Capture raw packets.
- nmap: Scan remote systems.