Debian and Ubuntu Linux Networking Cheat Sheet and Guide

General Description of Linux Networking

Linux networking is the collection of kernel facilities, device drivers, user-space services, configuration files, and command-line tools that connect a Debian or Ubuntu system to local networks, routed networks, and application services. The kernel provides interfaces, Ethernet and Wi-Fi data-link handling, IPv4 and IPv6, routing, neighbour discovery, TCP and UDP, packet filtering, traffic control, and network namespaces. User-space components select addresses, maintain routes, resolve names, synchronise time, authenticate users, mount remote file systems, and make configuration persistent across reboots.

A reliable administrator works from the bottom of the stack upward. First confirm that the device and link are present. Then validate the data-link state, IP address and subnet, neighbours, routes, DNS, transport ports, and finally the application. This layered approach avoids changing unrelated settings and makes failures easier to isolate.

Typical networking tasks include:

Discovering wired, wireless, physical, and virtual interfaces.
Assigning static or DHCP addresses, routes, DNS servers, and search domains.
Creating VLANs, bridges, virtual Ethernet pairs, and bonded interfaces.
Providing link failover or IEEE 802.3ad LACP aggregation.
Managing client services such as DNS, NTP, LDAP, and NFS.
Controlling traffic with UFW, nftables, and Linux traffic control.
Monitoring utilisation, errors, latency, packet loss, sockets, and application reachability.
Collecting logs and packet captures for repeatable troubleshooting.

Scope: This guide focuses on Debian and Ubuntu server and desktop systems. It covers Netplan, NetworkManager, systemd-networkd, and legacy ifupdown because the active configuration stack depends on the distribution release, installation type, and local policy.

Safety, Conventions, and Example Addresses

Warning: Changing an interface, default route, firewall, VLAN, or bond over the same remote session can disconnect you. Keep console or out-of-band access available, back up configuration files, schedule a rollback, and use netplan try rather than netplan apply for the first remote test.

Command prompts used in this guide:

$ command # Run as an ordinary user
# command # Run as root, or prefix the command with sudo

The examples use documentation-only address ranges so they are not mistaken for real production networks:

Purpose	Example
IPv4 LAN	192.0.2.0/24
Second IPv4 network	198.51.100.0/24
Third IPv4 network	203.0.113.0/24
IPv6 documentation prefix	2001:db8::/32
Example domain	example.com
Example interfaces	enp1s0, enp2s0, wlp2s0, bond0, vlan100

Before editing a persistent file, make a dated backup and validate syntax before activating it:

# stamp=$(date +%F-%H%M%S)
# cp -a /etc/netplan/01-netcfg.yaml \
/etc/netplan/01-netcfg.yaml.$stamp.bak
# netplan generate
# netplan try

Built-in utilities and commonly installed tools
Networking layers and layer-specific commands
Management of network services and configuration stacks
Configuration files, errors, and logs
Interface discovery and link management
Static and DHCP IP addressing
VLANs and IEEE 802.1Q tagging
Failover bonding and LACP aggregation
Routing and policy routing
Host naming and DNS client management
NTP client management
LDAP client management
NFS client management
Firewalls and network security
Traffic flow, bandwidth, and resource control
Monitoring and performance metrics
Troubleshooting tools and workflows
Command reference summary and authoritative references

Built-in Utilities and Commonly Installed Tools

Debian and Ubuntu include many core administration commands in the base system. Some diagnostic and service-specific tools are separate packages. The modern iproute2 family should be preferred over the older net-tools commands because it supports current kernel features and presents IPv4, IPv6, policy routing, tunnels, neighbours, bridges, and namespaces consistently.

Core Utilities Normally Available

Utility	Primary purpose	Example
ip	Interfaces, addresses, neighbours, routes, rules, tunnels, and namespaces.	ip -br address
ss	Listening and established TCP/UDP/UNIX sockets.	ss -lntup
systemctl	Start, stop, enable, and inspect networking services.	systemctl status NetworkManager
journalctl	Read boot, kernel, and service logs.	journalctl -b -u systemd-networkd
networkctl	Inspect and reconfigure interfaces managed by systemd-networkd.	networkctl status enp1s0
resolvectl	Inspect and manage systemd-resolved DNS state.	resolvectl status
hostnamectl	Display or set the static host name.	hostnamectl set-hostname web01.example.com
udevadm	Inspect device properties and monitor hotplug events.	udevadm info -q property -p /sys/class/net/enp1s0
sysctl	Read or change kernel networking parameters.	sysctl net.ipv4.ip_forward
/proc and /sys	Kernel counters and interface/device attributes.	cat /proc/net/dev

Common Packages to Install

Package	Important commands	Use
iproute2	ip, ss, bridge, tc, nstat	Core modern networking administration.
iputils-ping	ping	ICMP reachability and latency testing.
iputils-tracepath	tracepath	Path and path-MTU discovery without raw-socket privileges.
iputils-arping	arping	ARP reachability and duplicate-address checks.
ethtool	ethtool	Ethernet speed, duplex, driver, offload, ring, and hardware counters.
iw, rfkill	iw, rfkill	Wireless capabilities, association state, and radio blocking.
traceroute	traceroute	ICMP, UDP, or TCP path tracing.
netcat-openbsd	nc	TCP/UDP connection and listener testing.
tcpdump	tcpdump	Packet capture and protocol filtering.
dnsutils	dig, nslookup	DNS queries and response analysis.
nftables, ufw	nft, ufw	Native and simplified host firewall management.
pciutils, usbutils, lshw	lspci, lsusb, lshw	Hardware and driver discovery.
sysstat	sar	Historical and live network performance counters.
iperf3	iperf3	Controlled TCP/UDP throughput testing.
nload, iftop, bmon, vnstat	nload, iftop, bmon, vnstat	Interactive and historical bandwidth monitoring.
chrony	chronyd, chronyc	NTP time synchronisation client and server.
sssd-ldap, ldap-utils	sssctl, ldapsearch	LDAP identity/authentication client and directory queries.
nfs-common	mount.nfs, nfsstat, showmount	NFS client support and diagnostics.
net-tools	ifconfig, route, arp, netstat	Legacy compatibility only; not the preferred interface.

Install a practical troubleshooting set:

# apt update
# apt install -y iproute2 iputils-ping iputils-tracepath iputils-arping \
ethtool iw rfkill traceroute netcat-openbsd tcpdump dnsutils \
nftables ufw pciutils usbutils lshw sysstat iperf3

Modern Replacements for Legacy Commands

Legacy command	Preferred command	Example
ifconfig -a	ip address show / ip -br address	ip -br address
ifconfig eth0 up	ip link set dev eth0 up	ip link set dev enp1s0 up
route -n	ip route show	ip -4 route show
arp -n	ip neighbour show	ip neigh show dev enp1s0
netstat -lntup	ss -lntup	ss -lntup
brctl show	bridge link / ip link	bridge link show
vconfig	ip link type vlan	ip link add link enp1s0 name vlan100 type vlan id 100

Networking Layers and Layer-Specific Commands

The practical Linux networking stack can be viewed as a sequence of layers. Each layer depends on the one below it. A DNS failure, for example, should not be investigated before confirming that the interface has carrier, an address, a usable route, and transport reachability to the DNS server.

Layer	Questions to answer	Key inspection tools	Typical configuration
Physical	Is the device detected? Is the cable, radio, optic, driver, and carrier working?	lspci, lsusb, lshw, ethtool, iw, rfkill, journalctl -k	Driver/module options, ethtool link settings, systemd .link files
Data link	Is the interface up? What is the MAC, MTU, VLAN, bridge, bond, and neighbour state?	ip link, ip -s -d link, bridge, ip neigh, ethtool, iw	ip link, VLAN/bridge/bond profiles, Netplan, NetworkManager, networkd
IP and routing	Does the host have the correct prefix, gateway, route, and source address?	ip address, ip route, ip rule, ping, tracepath, arping	ip address/route, Netplan, nmcli, .network, /etc/network/interfaces
TCP and UDP	Is the service listening? Does a handshake or datagram exchange succeed?	ss, nc, tcpdump, nstat, iperf3	Application bind/listen settings, firewall, sysctl, traffic control
Name/application	Can names resolve and can the application protocol complete?	getent, resolvectl, dig, curl, openssl, journalctl	DNS, /etc/hosts, service configuration, certificates and access policy

Physical Layer

The physical layer covers the network adapter, bus, driver, cable or fibre, transceiver, radio, signal state, negotiated speed, and carrier. Linux represents a detected adapter as a network interface only after a driver binds to the device.

List PCI and USB network hardware and the associated kernel driver:

$ lspci -nnk | grep -A3 -i ‘ethernet\|network’
$ lsusb
# lshw -class network

Inspect the driver and firmware for an interface:

$ ethtool -i enp1s0
$ readlink -f /sys/class/net/enp1s0/device/driver
$ udevadm info -q property -p /sys/class/net/enp1s0

Check carrier, link negotiation, and recent kernel events:

Interpretation: carrier 1 normally means the physical link is detected; carrier 0 means no usable link. An administratively DOWN interface can still have a connected cable, so inspect both administrative state and carrier.

Data-Link Layer

The data-link layer handles Ethernet or Wi-Fi frames, MAC addresses, MTU, VLAN tags, bridges, bonding, and ARP or IPv6 neighbour discovery. The state UP means the interface is administratively enabled. LOWER_UP means the kernel sees a working lower-layer link.

Inspect link state, detailed attributes, and counters:

$ ip -br link
$ ip -details -statistics link show dev enp1s0
$ ethtool -S enp1s0
$ bridge link show
$ ip neighbour show

Bring an interface up or down temporarily and change its MTU:

# ip link set dev enp1s0 up
# ip link set dev enp1s0 mtu 1500
# ip link set dev enp1s0 down

Warning: Bringing down the interface carrying your SSH session immediately disconnects it. An MTU change can also interrupt active connections.

IP, ICMP, and Routing Layer

The IP layer assigns local IPv4 and IPv6 addresses, selects source addresses, maintains routing tables and policy rules, and reports network errors through ICMP or ICMPv6. A route must match the destination, and the selected source address must be valid on the outgoing path.

Display addresses, routes, rules, and the route the kernel would use for one destination:

$ ip -br address
$ ip -4 route show
$ ip -6 route show
$ ip rule show
$ ip route get 198.51.100.25
$ ip -6 route get 2001:db8:2::25

Test the local gateway and a routed destination:

$ ping -c 4 192.0.2.1
$ ping -c 4 -I enp1s0 198.51.100.25
$ tracepath 198.51.100.25

TCP and UDP Transport Layer

TCP provides a connection-oriented byte stream with handshakes, sequencing, retransmission, congestion control, and orderly close. UDP sends independent datagrams without a transport-layer handshake. A host can have correct IP connectivity while an application still fails because no service is listening, the wrong address is bound, or a firewall blocks the port.

List listening sockets and established connections:

$ ss -lntup
$ ss -tnp state established
$ ss -unp
$ ss -s

Test a TCP port and a UDP service:

$ nc -vz -w 3 192.0.2.20 443
$ nc -vzu -w 3 192.0.2.53 53

UDP testing: A successful UDP nc command does not always prove that the application replied because UDP has no handshake. Confirm with an application query such as dig and, when needed, a packet capture.

A Layered Test Sequence

Confirm that the kernel detects the adapter and that the correct driver is loaded.
Confirm administrative state, carrier, speed, duplex, MTU, VLAN, bridge, and bond membership.
Confirm the expected IPv4 or IPv6 address and prefix.
Confirm ARP or neighbour discovery to the local gateway.
Confirm the default and destination-specific routes, including policy rules.
Test reachability by numeric address before testing DNS.
Confirm that the local or remote application port is listening and permitted by firewalls.
Capture packets and compare timestamps with service and kernel logs when the failure remains unclear.

$ ip -br link
$ ethtool enp1s0
$ ip -br address
$ ip neigh show dev enp1s0
$ ip route get 198.51.100.25
$ ping -c 3 198.51.100.25
$ getent ahosts app.example.com
$ nc -vz app.example.com 443
# tcpdump -ni enp1s0 host 198.51.100.25 and port 443

Management of Network and Networking Services

A Debian or Ubuntu installation can use more than one networking component, but a given interface should normally have only one configuration owner. Netplan is a declarative front end that generates configuration for NetworkManager or systemd-networkd. NetworkManager is common on desktops and is also suitable for servers. systemd-networkd is lightweight and common on servers. Traditional Debian systems may use ifupdown through the networking service.

Identify the Active Configuration Stack

Check service state and ask each manager what it owns:

$ systemctl is-active NetworkManager systemd-networkd networking systemd-resolved
$ nmcli general status 2>/dev/null
$ nmcli device status 2>/dev/null
$ networkctl list 2>/dev/null
$ netplan get 2>/dev/null
$ grep -R ‘^[[:space:]]*iface ‘ /etc/network/interfaces /etc/network/interfaces.d 2>/dev/null

Determine which process is controlling one interface:

$ nmcli -f GENERAL.DEVICE,GENERAL.STATE,GENERAL.CONNECTION device show enp1s0
$ networkctl status enp1s0
$ grep -R “enp1s0” /etc/netplan /etc/systemd/network /etc/network/interfaces* 2>/dev/null

Rule: Do not define the same address or route in Netplan, a NetworkManager profile, a systemd-networkd file, and /etc/network/interfaces at the same time. Duplicate ownership causes flapping addresses, overwritten routes, and confusing DNS behaviour.

systemd Service Management

Inspect, start, restart, and enable a networking service:

$ systemctl status NetworkManager
# systemctl restart NetworkManager
# systemctl enable –now systemd-networkd
$ systemctl is-enabled systemd-networkd

Warning: Restarting a network manager can interrupt every interface it controls. Prefer a connection-specific reload or reapply operation when working remotely.

Netplan Management

Netplan reads YAML from /etc/netplan and generates backend configuration. Validate and test before committing:

# chmod 600 /etc/netplan/*.yaml
# netplan generate
# netplan get
# netplan try
# netplan apply
$ netplan status –all

Change one value with the Netplan CLI and review the result before applying:

# netplan set ethernets.enp1s0.dhcp4=true
# netplan get ethernets.enp1s0
# netplan try

netplan try: The command applies the proposed configuration and asks for confirmation. If confirmation is not received, Netplan attempts to roll back, making it safer than a blind remote apply. Console access is still recommended.

NetworkManager Management

NetworkManager stores configuration as connection profiles. A profile can be associated with a device and activated or deactivated independently:

$ nmcli general status
$ nmcli device status
$ nmcli connection show
$ nmcli connection show –active
$ nmcli connection show “Wired connection 1”
# nmcli connection reload
# nmcli connection up “Wired connection 1”
# nmcli device reapply enp1s0

Temporarily disable and re-enable all NetworkManager networking:

# nmcli networking off
# nmcli networking on

Warning: nmcli networking off disconnects NetworkManager-managed interfaces and should not be used from a session that depends on them.

systemd-networkd Management

Inspect status and reload definitions without restarting all links:

$ networkctl list
$ networkctl status enp1s0
# networkctl reload
# networkctl reconfigure enp1s0
# networkctl renew enp1s0

Use networkctl lldp when LLDP is enabled to learn adjacent switch information:

$ networkctl lldp enp1s0

ifupdown Management

Traditional ifupdown reads /etc/network/interfaces and included files. Bring up or down only the named interface:

# ifup enp1s0
# ifdown enp1s0
# ifdown enp1s0 && ifup enp1s0
$ ifquery enp1s0

Warning: ifdown followed by ifup is risky remotely. Commands in pre-up, up, post-up, pre-down, down, and post-down stanzas can also fail and leave partial state.

Management of Networking Configuration Files

Persistent networking state is stored in different files depending on the active stack. Generated files should not be edited directly because the generator will overwrite them.

Path	Owner or purpose	Important notes
/etc/netplan/*.yaml	Netplan source configuration	Use spaces, not tabs. Set restrictive permissions. Validate with netplan generate.
/run/systemd/network/* and /run/NetworkManager/*	Generated runtime files	Do not edit; regenerated by Netplan or services.
/etc/NetworkManager/NetworkManager.conf	NetworkManager main configuration	Use /etc/NetworkManager/conf.d/*.conf for local drop-ins where practical.
/etc/NetworkManager/system-connections/*.nmconnection	NetworkManager connection profiles	Usually mode 600 and owned by root. Prefer nmcli to edit.
/etc/systemd/network/*.network	systemd-networkd link addressing and routing	Lexical ordering matters; first matching file usually wins.
/etc/systemd/network/*.netdev	Virtual devices such as bond, bridge, VLAN, tunnel	Create the device, then reference it from .network files.
/etc/systemd/network/*.link	Persistent link properties and naming	Applied early by udev; match carefully.
/etc/network/interfaces	ifupdown configuration	May source /etc/network/interfaces.d/*.
/etc/hostname and /etc/hosts	Local host naming	Keep the static host name and local address mapping consistent.
/etc/nsswitch.conf	Name service lookup order	Controls files, DNS, systemd, LDAP/SSSD, and other databases.
/etc/resolv.conf	Resolver entry point	Often a symlink managed by systemd-resolved or NetworkManager. Do not overwrite blindly.
/etc/systemd/resolved.conf.d/*.conf	systemd-resolved policy	Use drop-ins and restart systemd-resolved after changes.
/etc/chrony/chrony.conf	Chrony NTP configuration	Distribution includes and paths can vary.
/etc/sssd/sssd.conf	SSSD LDAP identity and authentication	Must normally be root-owned and mode 600.
/etc/fstab	Persistent NFS and local mounts	Use _netdev and systemd automount options for resilient boot behaviour.
/etc/nftables.conf	Persistent nftables ruleset	Validate before loading and retain console access.
/etc/ufw/*	UFW policy and generated rules	Use ufw commands for ordinary rule management.
/etc/sysctl.d/*.conf	Persistent kernel networking parameters	Apply with sysctl –system.

Safe Editing and Validation

Identify the active manager and the source file that owns the interface.
Copy the file with metadata before editing.
Make the smallest possible change and keep the old session open.
Validate syntax without applying when the tool supports it.
Apply to one interface or profile rather than restarting all networking.
Verify link, address, routes, DNS, and application connectivity.
Only then remove obsolete configuration or close the recovery session.

# install -m 600 /dev/null /etc/netplan/99-local.yaml
# editor /etc/netplan/99-local.yaml
# netplan generate
# netplan try

Validate an nftables file without applying it:

# nft –check –file /etc/nftables.conf

Check NetworkManager profile values and reload profile files:

$ nmcli –fields all connection show “server-lan”
# nmcli connection reload

Errors, Logs, and Event Monitoring

On current Debian and Ubuntu systems, the systemd journal is the primary source for service and kernel events. Traditional files such as /var/log/syslog and /var/log/kern.log may also exist when rsyslog is installed and configured.

General and Kernel Logs

$ journalctl -b                         # All messages from this boot
$ journalctl -k -b                      # Kernel messages from this boot
$ journalctl -p warning..alert -b       # Warning and higher priorities
$ journalctl –since “30 minutes ago”
# journalctl -f                         # Follow new events

Filter kernel events for network drivers, link state, MTU, and firmware:

Manager and Service Logs

$ journalctl -b -u NetworkManager
$ journalctl -b -u systemd-networkd
$ journalctl -b -u systemd-resolved
$ journalctl -b -u networking
$ journalctl -b -u chrony
$ journalctl -b -u sssd
$ journalctl -b -u nftables
$ journalctl -b -u ufw

Follow NetworkManager events for one device while reproducing a problem:

# journalctl -f -u NetworkManager | grep –line-buffered enp1s0
$ nmcli monitor

Temporarily increase NetworkManager logging, then restore the normal level:

# nmcli general logging level DEBUG domains ALL
# journalctl -f -u NetworkManager
# nmcli general logging level INFO domains DEFAULT

Warning: Debug logging can reveal addresses, host names, and connection details and can grow rapidly. Enable it only for a bounded test and restore normal logging afterward.

Live Link, Address, and Route Events

Use ip monitor to watch kernel network state change without repeatedly polling:

$ ip monitor all
$ ip monitor link
$ ip monitor address
$ ip monitor route

Monitor udev add, remove, and property events for network devices:

# udevadm monitor –kernel –udev –property –subsystem-match=net

Common Error Messages and Their Layer

Message or symptom	Likely layer	First checks
NO-CARRIER or carrier 0	Physical/data link	Cable, optic, radio, switch port, ethtool, rfkill, driver logs.
RTNETLINK answers: File exists	IP/routing	Existing address, route, rule, or duplicate manager ownership.
Network is unreachable	Routing	Address/prefix, link route, default route, policy rules.
No route to host	Routing/firewall	Route lookup, neighbour state, ICMP reject, remote firewall.
Connection refused	TCP/application	Host reached, but no listener or an active reject. Check ss and service status.
Connection timed out	Path/firewall/application	Packet loss, silent firewall drop, incorrect route, service not replying.
Temporary failure in name resolution	DNS	resolv.conf link, resolvectl status, DNS route/reachability.
YAML parse or inconsistent indentation	Persistent configuration	Spaces only, indentation, netplan generate output.
DHCP timeout or no lease	Data link/DHCP	Carrier, VLAN, DHCP broadcasts, server scope, firewall, logs.
Neighbour FAILED or INCOMPLETE	Data link	Wrong subnet/VLAN, gateway offline, switch filtering, duplicate address.

Interface Discovery and Link Management

Discover All Interfaces

Display a concise list of interface names, link state, and addresses:

$ ip -br link
$ ip -br address
$ ls -1 /sys/class/net
$ networkctl list
$ nmcli device status

Show only interfaces that are operationally up:

$ ip -br link | awk ‘$2 ~ /UP/ {print}’

Names: Predictable interface names such as enp1s0 describe device topology. Names such as eth0 can still be used when predictable naming is disabled or overridden.

Distinguish Physical and Virtual Interfaces

A physical interface normally has a device path under sysfs. Virtual devices such as loopback, bridge, bond, VLAN, dummy, veth, and tunnels often do not:

$ test -e /sys/class/net/enp1s0/device && echo physical-or-hardware-backed
$ readlink -f /sys/class/net/enp1s0/device
$ ethtool -i enp1s0
$ ip -details link show

List interface types with one command per device:

$ for path in /sys/class/net/*; do
>   iface=${path##*/}
>   echo “== $iface ==”
>   udevadm info -q property -p “$path” |
>     grep -E ‘^ID_NET_DRIVER=|^ID_BUS=’
> done

Discover Wireless Interfaces

List wireless physical radios, interfaces, and association state:

$ iw phy
$ iw dev
$ iw dev wlp2s0 link
$ iw dev wlp2s0 station dump

Check whether the radio is blocked and scan through NetworkManager:

$ rfkill list
# rfkill unblock wifi
$ nmcli radio wifi
$ nmcli device wifi list ifname wlp2s0

Connect to a WPA/WPA2 Personal network with NetworkManager:

# nmcli device wifi connect “ExampleSSID” password “replace-with-real-secret” ifname wlp2s0

Warning: Passwords entered on a command line can be exposed through shell history or process inspection. Prefer nmcli –ask or a protected profile when handling real credentials.

Find the MAC Address

Display the current MAC address:

$ ip link show dev enp1s0
$ cat /sys/class/net/enp1s0/address
$ nmcli -g GENERAL.HWADDR device show enp1s0

Display the permanent hardware address when supported:

$ ethtool -P enp1s0

Temporarily assign a locally administered MAC address:

# ip link set dev enp1s0 down
# ip link set dev enp1s0 address 02:00:00:00:01:10
# ip link set dev enp1s0 up

MAC changes: A MAC change can invalidate switch security, DHCP reservations, neighbour caches, and active connections. Use a locally administered address with the second-least-significant bit set, such as a first octet of 02.

Find Advanced Interface Properties

$ ip -details -statistics link show dev enp1s0
$ ethtool enp1s0
$ ethtool -i enp1s0        # Driver, firmware, bus information
$ ethtool -k enp1s0        # Offload features
$ ethtool -g enp1s0        # Ring parameters
$ ethtool -c enp1s0        # Interrupt coalescing
$ ethtool -a enp1s0        # Pause-frame settings
$ ethtool -S enp1s0        # Driver/hardware statistics
$ ethtool -m enp1s0        # Optical module data, if supported

Inspect MTU, queue count, qdisc, state, and master device in one line:

$ ip -d link show dev enp1s0

Display NetworkManager and networkd views:

$ nmcli –fields GENERAL,CAPABILITIES,WIRED-PROPERTIES device show enp1s0
$ networkctl status enp1s0

Find Link Speed and Duplex

ethtool is the most direct tool for Ethernet negotiation:

$ ethtool enp1s0 | grep -E ‘Speed:|Duplex:|Auto-negotiation:|Link detected:’

Alternative views are useful for scripting:

$ cat /sys/class/net/enp1s0/speed 2>/dev/null
$ nmcli -g GENERAL.SPEED device show enp1s0
$ networkctl status enp1s0

Units: The sysfs speed value is normally in megabits per second. A value of -1 or an error can mean the link is down or the driver does not expose speed.

Configure Fixed or Automatic Link Speed

Set 100 Mbit/s full duplex with autonegotiation disabled until the next reset or reboot:

# ethtool -s enp1s0 autoneg off speed 100 duplex full
$ ethtool enp1s0

Return to autonegotiation:

# ethtool -s enp1s0 autoneg on
$ ethtool enp1s0

Warning: Both ends must use compatible settings. A forced speed or duplex mismatch can cause loss, late collisions, poor throughput, or no link. Copper Gigabit Ethernet normally requires autonegotiation; do not force 1000BASE-T off-negotiation.

Persist a fixed 100 Mbit/s full-duplex mode in a NetworkManager profile:

# nmcli connection modify “server-lan” \
802-3-ethernet.auto-negotiate no \
802-3-ethernet.speed 100 \
802-3-ethernet.duplex full
# nmcli connection up “server-lan”

For 1000BASE-T, retain autonegotiation. NetworkManager can advertise only 1 Gbit/s full duplex while still negotiating:

# nmcli connection modify “server-lan” \
802-3-ethernet.auto-negotiate yes \
802-3-ethernet.speed 1000 \
802-3-ethernet.duplex full
# nmcli connection up “server-lan”

Restore unrestricted automatic negotiation in NetworkManager:

# nmcli connection modify “server-lan” \
802-3-ethernet.auto-negotiate yes \
802-3-ethernet.speed 0 \
802-3-ethernet.duplex “”
# nmcli connection up “server-lan”

Persist a fixed 100 Mbit/s link mode with a systemd link file:

# cat >/etc/systemd/network/10-enp1s0.link <<‘EOF’
[Match]
OriginalName=enp1s0

[Link]
AutoNegotiation=no
BitsPerSecond=100M
Duplex=full
EOF
# udevadm control –reload
# udevadm trigger –action=add /sys/class/net/enp1s0

Activation: A .link change is applied when the device is recreated or retriggered. It can disrupt the link. A reboot is often the safest planned activation method.

Persist a fixed 100 Mbit/s command under ifupdown:

auto enp1s0
iface enp1s0 inet dhcp
pre-up /usr/sbin/ethtool -s enp1s0 autoneg off speed 100 duplex full

Administrative State, MTU, and Queue State

# ip link set dev enp1s0 up
# ip link set dev enp1s0 mtu 9000
$ ip -d link show dev enp1s0
$ ip -s link show dev enp1s0

Warning: Jumbo frames require every relevant path component to support the larger MTU. An inconsistent path can allow small pings while large TCP sessions stall.

Probe IPv4 path MTU with the do-not-fragment flag. For a 1500-byte Ethernet path, 1472 bytes of ICMP payload plus 28 bytes of IPv4/ICMP headers totals 1500:

$ ping -c 3 -M do -s 1472 198.51.100.25
$ tracepath 198.51.100.25

Configure Virtual Interfaces

Linux supports virtual interfaces for testing, containers, virtual machines, routing, service addresses, and network segmentation. Temporary objects created with ip disappear at reboot unless a network manager recreates them.

Dummy Interface

# ip link add dummy0 type dummy
# ip address add 192.0.2.200/32 dev dummy0
# ip link set dummy0 up
$ ip -br address show dummy0
# ip link delete dummy0

Persist a dummy interface with Netplan:

network:
version: 2
dummy-devices:
    dummy0:
      addresses:
        – 192.0.2.200/32

Create a persistent NetworkManager dummy profile:

# nmcli connection add type dummy ifname dummy0 con-name dummy0 \
ipv4.method manual ipv4.addresses 192.0.2.200/32 ipv6.method disabled
# nmcli connection up dummy0

Virtual Ethernet Pair

A veth pair acts like a virtual patch cable. Frames entering one end leave the other and are commonly used with namespaces and containers:

# ip link add veth-a type veth peer name veth-b
# ip link set veth-a up
# ip link set veth-b up
$ ip -d link show veth-a
# ip link delete veth-a

Bridge Interface

A bridge forwards Ethernet frames between member ports and is commonly used for virtual machines:

# ip link add br0 type bridge
# ip link set enp2s0 master br0
# ip link set enp2s0 up
# ip link set br0 up
$ bridge link show
$ bridge fdb show br br0

Address placement: When a physical interface becomes a bridge port, place the host IP address on the bridge, not on the enslaved physical interface.

Persist a bridge with Netplan:

network:
version: 2
renderer: networkd
ethernets:
    enp2s0:
      dhcp4: false
bridges:
    br0:
      interfaces: [enp2s0]
      addresses: [198.51.100.10/24]
      parameters:
        stp: true
        forward-delay: 4

Macvlan Interface

A macvlan gives a virtual interface its own MAC address on top of a parent interface. In bridge mode, peers can communicate through the lower interface, although direct host-to-macvlan communication needs extra design:

# ip link add macvlan0 link enp1s0 type macvlan mode bridge
# ip address add 192.0.2.210/24 dev macvlan0
# ip link set macvlan0 up
$ ip -d link show macvlan0
# ip link delete macvlan0

Static and DHCP IP Addressing

An IP address is written with a prefix length, such as 192.0.2.10/24 or 2001:db8:1::10/64. The prefix identifies which destinations are on-link. A default gateway is used for destinations not covered by a more specific route. Temporary ip commands modify the running kernel only; persistent settings must be stored in the active network manager.

Inspect Current Addresses and Address Metadata

$ ip -br address
$ ip -4 address show dev enp1s0
$ ip -6 address show dev enp1s0
$ ip -details address show dev enp1s0

Useful address fields include scope, dynamic, secondary, tentative, deprecated, valid_lft, and preferred_lft. A tentative IPv6 address is still undergoing duplicate-address detection.

Temporary Static IPv4 Address – Add, Change, and Delete

Add a second address without removing existing addresses:

# ip address add 192.0.2.10/24 dev enp1s0
# ip link set dev enp1s0 up
$ ip -br address show dev enp1s0

Replace an address entry, including its lifetime or label attributes:

# ip address replace 192.0.2.10/24 dev enp1s0

Delete one exact address:

# ip address del 192.0.2.10/24 dev enp1s0

Flush all global IPv4 addresses from an interface:

# ip -4 address flush dev enp1s0 scope global

Warning: Flushing addresses can remove DHCP and static addresses at once and disconnect every session using the interface. Prefer deleting the exact unwanted prefix.

Temporary Static IPv6 Address

# ip -6 address add 2001:db8:1::10/64 dev enp1s0
$ ip -6 address show dev enp1s0
# ip -6 address del 2001:db8:1::10/64 dev enp1s0

IPv6 gateways: An IPv6 default gateway is commonly a link-local address such as fe80::1 and may require an explicit interface, for example ip -6 route add default via fe80::1 dev enp1s0.

Persistent Static Address with Netplan

Example /etc/netplan/01-server-lan.yaml using systemd-networkd as the renderer:

network:
version: 2
renderer: networkd
ethernets:
    enp1s0:
      dhcp4: false
      dhcp6: false
      addresses:
        – 192.0.2.10/24
        – 2001:db8:1::10/64
      routes:
        – to: default
          via: 192.0.2.1
          metric: 100
        – to: default
          via: 2001:db8:1::1
          metric: 100
      nameservers:
        search: [example.com]
        addresses: [192.0.2.53, 192.0.2.54, 2001:db8:1::53]

Protect, validate, test, and inspect the configuration:

# chmod 600 /etc/netplan/01-server-lan.yaml
# netplan generate
# netplan try
$ netplan status –all
$ ip address show dev enp1s0
$ ip route show

Default routes: Current Netplan configurations should express gateways as routes. Older gateway4 and gateway6 keys can still appear in existing systems but are less flexible and are deprecated in newer schemas.

Persistent Static Address with NetworkManager

Create a new Ethernet profile with a static IPv4 address:

# nmcli connection add type ethernet ifname enp1s0 con-name server-lan \
ipv4.method manual \
ipv4.addresses 192.0.2.10/24 \
ipv4.gateway 192.0.2.1 \
ipv4.dns “192.0.2.53 192.0.2.54” \
ipv4.dns-search example.com \
ipv6.method auto
# nmcli connection up server-lan

Change the address and remove the old value:

# nmcli connection modify server-lan ipv4.addresses 192.0.2.20/24
# nmcli connection up server-lan
$ nmcli connection show server-lan

Add and remove a secondary address while retaining the primary:

# nmcli connection modify server-lan +ipv4.addresses 192.0.2.21/24
# nmcli connection modify server-lan -ipv4.addresses 192.0.2.21/24
# nmcli device reapply enp1s0

Persistent Static Address with systemd-networkd

Create /etc/systemd/network/20-enp1s0.network:

[Match]
Name=enp1s0

[Network]
Address=192.0.2.10/24
Address=2001:db8:1::10/64
DNS=192.0.2.53
DNS=192.0.2.54
Domains=example.com

[Route]
Destination=0.0.0.0/0
Gateway=192.0.2.1
Metric=100

[Route]
Destination=::/0
Gateway=2001:db8:1::1
Metric=100

Reload and reconfigure only the interface:

# networkctl reload
# networkctl reconfigure enp1s0
$ networkctl status enp1s0

Persistent Static Address with ifupdown

Example /etc/network/interfaces stanza:

auto enp1s0
iface enp1s0 inet static
    address 192.0.2.10
    netmask 255.255.255.0
    gateway 192.0.2.1
    up ip route add 198.51.100.0/24 via 192.0.2.254 dev enp1s0
    down ip route del 198.51.100.0/24 via 192.0.2.254 dev enp1s0

Apply during a maintenance window:

# ifdown enp1s0 && ifup enp1s0
$ ip -br address show dev enp1s0

Configure DHCP with Netplan

Obtain IPv4 and IPv6 configuration dynamically:

network:
version: 2
renderer: networkd
ethernets:
    enp1s0:
      dhcp4: true
      dhcp6: true

Use DHCP for the address but override route priority and ignore DHCP-provided DNS:

network:
version: 2
renderer: networkd
ethernets:
    enp1s0:
      dhcp4: true
      dhcp4-overrides:
        route-metric: 200
        use-dns: false
      nameservers:
      addresses: [192.0.2.53, 192.0.2.54]
# netplan generate
# netplan try
$ netplan status enp1s0

Configure DHCP with NetworkManager

Convert an existing profile to DHCP and clear manual IPv4 values:

# nmcli connection modify server-lan \
ipv4.method auto \
ipv4.addresses “” \
ipv4.gateway “” \
ipv4.routes “”
# nmcli connection up server-lan

Inspect DHCP-derived parameters:

$ nmcli -f GENERAL,IP4,DHCP4 device show enp1s0
$ journalctl -b -u NetworkManager | grep -i dhcp

Configure DHCP with systemd-networkd

[Match]
Name=enp1s0

[Network]
DHCP=yes

[DHCPv4]
RouteMetric=200
UseDNS=no
# networkctl reload
# networkctl reconfigure enp1s0
# networkctl renew enp1s0
$ networkctl status enp1s0

Configure DHCP with ifupdown

auto enp1s0
iface enp1s0 inet dhcp

Request a new lease through ifupdown or, when the isc-dhcp-client package is installed, with dhclient:

# ifdown enp1s0 && ifup enp1s0
# dhclient -r enp1s0
# dhclient -v enp1s0

Verify a DHCP Lease

$ ip -br address show dev enp1s0
$ ip route show dev enp1s0
$ resolvectl status enp1s0
$ nmcli -f DHCP4,DHCP6 device show enp1s0
$ networkctl status enp1s0
$ journalctl -b | grep -Ei “dhcp|lease”

A valid lease normally supplies an address and prefix, one or more routes, lease lifetimes, and often DNS servers and search domains. Missing DNS does not mean the address lease failed; inspect each DHCP option separately.

Duplicate-Address Checks

Before assigning a static IPv4 address, send duplicate-address probes from the intended interface:

# arping -D -I enp1s0 -c 3 192.0.2.10

After assigning the address, announce it and update neighbour caches:

# arping -A -I enp1s0 -c 3 192.0.2.10

Caution: No reply does not prove that an address is unused if filtering, VLAN errors, sleeping systems, or non-ARP devices are present. Confirm with the address-management source of truth when available.

VLANs and IEEE 802.1Q Tagging

A VLAN separates Layer 2 broadcast domains by adding an IEEE 802.1Q tag containing a VLAN identifier. A switch access port normally carries one untagged VLAN. A trunk carries one or more tagged VLANs. The Linux parent interface must connect to a switch port configured for the same tagging model and allowed VLAN IDs.

Temporary VLAN Interface

Create VLAN 100 on parent enp1s0, assign an address, and activate it:

# ip link add link enp1s0 name vlan100 type vlan id 100
# ip address add 192.0.2.10/24 dev vlan100
# ip link set dev enp1s0 up
# ip link set dev vlan100 up
$ ip -d link show vlan100
$ ip -br address show vlan100

Delete the VLAN interface:

# ip link delete vlan100

Persistent VLAN with Netplan

network:
version: 2
renderer: networkd
ethernets:
    enp1s0:
      dhcp4: false
vlans:
    vlan100:
      id: 100
      link: enp1s0
      addresses: [192.0.2.10/24]
      routes:
        – to: default
          via: 192.0.2.1
      nameservers:
        addresses: [192.0.2.53, 192.0.2.54]
# netplan generate
# netplan try
$ ip -d link show vlan100

Persistent VLAN with NetworkManager

# nmcli connection add type vlan con-name vlan100 ifname vlan100 \
dev enp1s0 id 100 \
ipv4.method manual ipv4.addresses 192.0.2.10/24 \
ipv4.gateway 192.0.2.1 ipv4.dns “192.0.2.53 192.0.2.54”
# nmcli connection up vlan100
$ nmcli connection show vlan100

Persistent VLAN with systemd-networkd

Create /etc/systemd/network/20-vlan100.netdev:

[NetDev]
Name=vlan100
Kind=vlan

[VLAN]
Id=100

Attach the VLAN to the parent in /etc/systemd/network/20-enp1s0.network:

[Match]
Name=enp1s0

[Network]
VLAN=vlan100

Address it in /etc/systemd/network/30-vlan100.network:

[Match]
Name=vlan100

[Network]
Address=192.0.2.10/24
Gateway=192.0.2.1
DNS=192.0.2.53
# networkctl reload
# networkctl reconfigure enp1s0 vlan100
$ networkctl status vlan100

Persistent VLAN with ifupdown

Install VLAN support if required and use the dotted interface naming convention:

# apt install -y vlan

auto enp1s0.100
iface enp1s0.100 inet static
    address 192.0.2.10
    netmask 255.255.255.0
    gateway 192.0.2.1
    vlan-raw-device enp1s0
# ifup enp1s0.100
$ ip -d link show enp1s0.100

VLAN Verification and Troubleshooting

$ ip -d link show type vlan
$ bridge vlan show
# tcpdump -eni enp1s0 vlan 100
# tcpdump -ni vlan100 arp or icmp

If no tagged frames leave the parent, confirm that the VLAN interface is up and traffic is routed through it.
If tagged frames leave but no replies return, verify the switch trunk, allowed VLAN list, native VLAN, and remote VLAN membership.
If untagged traffic is expected, configure the host on the physical interface rather than creating an 802.1Q subinterface.
When using jumbo frames, include the VLAN overhead in the end-to-end MTU design and verify every switch hop.

Failover IP Address over Two Interfaces

For one host with two physical links, the normal method is an active-backup bond. The IP address is assigned once to bond0, not independently to both member interfaces. One member carries traffic while the other takes over after link failure. This keeps routing and application binding stable and allows gratuitous ARP or neighbour advertisements to update the network after failover. Both member links normally need equivalent Layer 2 and VLAN reachability to the same subnet; otherwise failover can preserve link state while still losing network reachability.

Different requirement: Moving a service IP between two separate hosts is a high-availability problem and normally uses VRRP/keepalived, a cluster manager, or a load balancer. The examples here provide link failover inside one host.

Active-Backup Bond with Netplan

network:
version: 2
renderer: networkd
ethernets:
    enp1s0:
      dhcp4: false
      optional: true
    enp2s0:
      dhcp4: false
      optional: true
bonds:
    bond0:
      interfaces: [enp1s0, enp2s0]
      addresses: [192.0.2.10/24]
      routes:
        – to: default
          via: 192.0.2.1
      nameservers:
        addresses: [192.0.2.53, 192.0.2.54]
      parameters:
        mode: active-backup
        primary: enp1s0
        mii-monitor-interval: 100
        gratuitous-arp: 3
# netplan generate
# netplan try
$ cat /proc/net/bonding/bond0
$ ip -d link show bond0

The optional fail-over-mac-policy parameter can be none, active, or follow. Choose it only after considering switch port security, virtualisation, and hardware behaviour; the default policy is often the least surprising starting point.

Active-Backup Bond with NetworkManager

# nmcli connection add type bond ifname bond0 con-name bond0 \
bond.options “mode=active-backup,miimon=100,primary=enp1s0”
# nmcli connection add type ethernet ifname enp1s0 con-name bond0-port1 controller bond0
# nmcli connection add type ethernet ifname enp2s0 con-name bond0-port2 controller bond0
# nmcli connection modify bond0 \
ipv4.method manual ipv4.addresses 192.0.2.10/24 \
ipv4.gateway 192.0.2.1 ipv4.dns “192.0.2.53 192.0.2.54” \
ipv6.method disabled
# nmcli connection up bond0
$ nmcli device status
$ nmcli connection show –active
$ cat /proc/net/bonding/bond0

Active-Backup Bond with systemd-networkd

Create /etc/systemd/network/10-bond0.netdev:

[NetDev]
Name=bond0
Kind=bond

[Bond]
Mode=active-backup
MIIMonitorSec=100ms

Create a matching member file such as /etc/systemd/network/20-bond-members.network:

[Match]
Name=enp1s0 enp2s0

[Network]
Bond=bond0

[Link]
RequiredForOnline=no

Address bond0 in /etc/systemd/network/30-bond0.network:

[Match]
Name=bond0

[Network]
Address=192.0.2.10/24
Gateway=192.0.2.1
DNS=192.0.2.53
# systemctl enable –now systemd-networkd
# networkctl reload
$ networkctl status bond0
$ cat /proc/net/bonding/bond0

Active-Backup Bond with ifupdown

Install the bonding integration and configure the IP only on bond0:

# apt install -y ifenslave

auto bond0
iface bond0 inet static
    address 192.0.2.10
    netmask 255.255.255.0
    gateway 192.0.2.1
    bond-slaves enp1s0 enp2s0
    bond-mode active-backup
    bond-miimon 100
    bond-primary enp1s0
# ifup bond0
$ cat /proc/net/bonding/bond0

Test Active-Backup Failover

Start a continuous ping through bond0 and note the active member.
Disable the active switch port or administratively lower the active member.
Confirm that the standby becomes active and packet loss is limited to the detection interval.
Re-enable the member and observe whether primary re-selection matches policy.
Check neighbour tables on adjacent systems if traffic does not resume.

$ watch -n 1 cat /proc/net/bonding/bond0
$ ping -I bond0 192.0.2.1
# ip link set enp1s0 down
# ip link set enp1s0 up

LACP / IEEE 802.3ad Aggregation

An 802.3ad bond negotiates a link aggregation group with the switch using LACP. It can provide link redundancy and aggregate bandwidth across multiple flows. A single flow is normally hashed to one member, so one TCP session may not exceed one physical link. The switch ports must be in the same compatible LACP port-channel; connecting members to independent switches requires multi-chassis link aggregation support on those switches.

LACP Bond with Netplan

network:
version: 2
renderer: networkd
ethernets:
    enp1s0:
      dhcp4: false
    enp2s0:
      dhcp4: false
bonds:
    bond0:
      interfaces: [enp1s0, enp2s0]
      addresses: [192.0.2.10/24]
      routes:
        – to: default
          via: 192.0.2.1
      parameters:
        mode: 802.3ad
        lacp-rate: fast
        mii-monitor-interval: 100
        transmit-hash-policy: layer3+4
        min-links: 1
# netplan generate
# netplan try
$ cat /proc/net/bonding/bond0

LACP Bond with NetworkManager

# nmcli connection add type bond ifname bond0 con-name bond0 \
bond.options “mode=802.3ad,miimon=100,lacp_rate=fast,xmit_hash_policy=layer3+4”
# nmcli connection add type ethernet ifname enp1s0 con-name bond0-port1 controller bond0
# nmcli connection add type ethernet ifname enp2s0 con-name bond0-port2 controller bond0
# nmcli connection modify bond0 \
ipv4.method manual ipv4.addresses 192.0.2.10/24 \
ipv4.gateway 192.0.2.1 ipv4.dns “192.0.2.53 192.0.2.54”
# nmcli connection up bond0

LACP Bond with systemd-networkd

[NetDev]
Name=bond0
Kind=bond

[Bond]
Mode=802.3ad
MIIMonitorSec=100ms
LACPTransmitRate=fast
TransmitHashPolicy=layer3+4
MinLinks=1

Use the same member and bond0 .network pattern shown for active-backup, then reload networkd. The switch-side LACP group must already be compatible or the members may remain collecting/distributing false.

LACP Bond with ifupdown

auto bond0
iface bond0 inet static
    address 192.0.2.10
    netmask 255.255.255.0
    gateway 192.0.2.1
    bond-slaves enp1s0 enp2s0
    bond-mode 802.3ad
    bond-miimon 100
    bond-lacp-rate 1
    bond-xmit-hash-policy layer3+4

Verify LACP State and Distribution

$ cat /proc/net/bonding/bond0
$ ip -s -d link show bond0
$ ip -s link show enp1s0
$ ip -s link show enp2s0
$ ethtool enp1s0
$ ethtool enp2s0

The aggregator IDs, actor/partner keys, and partner MAC should be consistent for members in the same LAG.
Both members should report the expected speed and full duplex.
Use several parallel iperf3 streams to exercise hashing across members.
Unexpected one-way traffic often indicates an inconsistent switch port-channel or VLAN list.

$ iperf3 -c 198.51.100.20 -P 8
$ watch -n 1 “ip -s link show enp1s0; ip -s link show enp2s0”

Routing

Linux selects the most specific matching route, then applies route preference and metrics. Connected routes are normally created from interface prefixes. Additional tables and ip rules can select routes by source address, destination, incoming interface, firewall mark, or other policy.

List All Routes and Rules

$ ip -4 route show
$ ip -6 route show
$ ip route show table all
$ ip -6 route show table all
$ ip rule show
$ ip -6 rule show
$ ip route get 198.51.100.25
$ ip route get 198.51.100.25 from 192.0.2.10

Show routes associated with one device or protocol:

$ ip route show dev enp1s0
$ ip route show proto dhcp
$ ip route show default

Temporary Default Route – Add, Change, and Delete

# ip route add default via 192.0.2.1 dev enp1s0 metric 100
# ip route replace default via 192.0.2.254 dev enp1s0 metric 100
# ip route del default via 192.0.2.254 dev enp1s0

IPv6 default route through a link-local gateway:

# ip -6 route add default via fe80::1 dev enp1s0 metric 100
# ip -6 route del default via fe80::1 dev enp1s0

Temporary Static Route – Add, Change, and Delete

# ip route add 198.51.100.0/24 via 192.0.2.254 dev enp1s0 metric 50
# ip route change 198.51.100.0/24 via 192.0.2.253 dev enp1s0 metric 50
# ip route replace 198.51.100.0/24 via 192.0.2.253 dev enp1s0 metric 50
# ip route del 198.51.100.0/24 via 192.0.2.253 dev enp1s0

Create special-purpose routes:

# ip route add blackhole 203.0.113.0/24
# ip route add 198.51.100.25/32 dev enp1s0 scope link
# ip route del blackhole 203.0.113.0/24

replace: ip route replace is useful in scripts because it creates the route when absent and replaces it when present. Check ip route get afterward to confirm the selected source and next hop.

Permanent Default and Static Routes with Netplan

network:
version: 2
renderer: networkd
ethernets:
    enp1s0:
      addresses: [192.0.2.10/24]
      routes:
        – to: default
          via: 192.0.2.1
          metric: 100
        – to: 198.51.100.0/24
          via: 192.0.2.254
          metric: 50
        – to: 203.0.113.25/32
          type: blackhole
# netplan generate
# netplan try
$ ip route show

Permanent Routes with NetworkManager

Set the default gateway and add a static route to an existing profile:

# nmcli connection modify server-lan ipv4.gateway 192.0.2.1
# nmcli connection modify server-lan \
+ipv4.routes “198.51.100.0/24 192.0.2.254 50”
# nmcli connection modify server-lan ipv4.route-metric 100
# nmcli connection up server-lan
$ nmcli -f ipv4.gateway,ipv4.routes,ipv4.route-metric connection show server-lan

Delete the exact static route entry:

# nmcli connection modify server-lan \
-ipv4.routes “198.51.100.0/24 192.0.2.254 50”
# nmcli device reapply enp1s0

Permanent Routes with systemd-networkd

[Match]
Name=enp1s0

[Network]
Address=192.0.2.10/24

[Route]
Destination=0.0.0.0/0
Gateway=192.0.2.1
Metric=100

[Route]
Destination=198.51.100.0/24
Gateway=192.0.2.254
Metric=50
# networkctl reload
# networkctl reconfigure enp1s0
$ ip route show

Permanent Routes with ifupdown

auto enp1s0
iface enp1s0 inet static
    address 192.0.2.10
    netmask 255.255.255.0
    gateway 192.0.2.1
    up ip route replace 198.51.100.0/24 via 192.0.2.254 dev enp1s0 metric 50
    down ip route del 198.51.100.0/24 via 192.0.2.254 dev enp1s0 metric 50 || true

Multiple Default Routes and Metrics

A lower metric is preferred when otherwise equivalent routes exist. For example, use the wired default as primary and Wi-Fi as backup:

# ip route replace default via 192.0.2.1 dev enp1s0 metric 100
# ip route replace default via 198.51.100.1 dev wlp2s0 metric 600
$ ip route show default
$ ip route get 203.0.113.25

Netplan DHCP route metrics:

network:
version: 2
ethernets:
    enp1s0:
      dhcp4: true
      dhcp4-overrides:
        route-metric: 100
wifis:
    wlp2s0:
      dhcp4: true
    dhcp4-overrides:
        route-metric: 600
      access-points:
        “ExampleSSID”:
          password: “replace-with-real-secret”

Policy Routing

Policy routing selects a table before the normal destination lookup. The following temporary example sends traffic sourced from 192.0.2.10 through table 100:

# ip route add table 100 192.0.2.0/24 dev enp1s0 src 192.0.2.10
# ip route add table 100 default via 192.0.2.1 dev enp1s0
# ip rule add priority 100 from 192.0.2.10/32 table 100
$ ip rule show
$ ip route show table 100
$ ip route get 203.0.113.25 from 192.0.2.10

Remove the policy in reverse order:

# ip rule del priority 100
# ip route flush table 100

Persist the same policy with Netplan:

network:
version: 2
ethernets:
    enp1s0:
      addresses: [192.0.2.10/24]
      routes:
        – to: 192.0.2.0/24
          scope: link
          table: 100
        – to: default
          via: 192.0.2.1
          table: 100
      routing-policy:
        – from: 192.0.2.10/32
          table: 100
          priority: 100

Warning: Policy rules can create asymmetric paths that stateful firewalls or reverse-path filtering reject. Always inspect both forward and return routes.

Enable IP Forwarding

Temporarily enable IPv4 and IPv6 forwarding for a router or gateway:

# sysctl -w net.ipv4.ip_forward=1
# sysctl -w net.ipv6.conf.all.forwarding=1

Persist the settings in /etc/sysctl.d/60-router.conf:

net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
# sysctl –system
$ sysctl net.ipv4.ip_forward net.ipv6.conf.all.forwarding

Forwarding security: Enabling forwarding does not create firewall rules or NAT. Add an explicit nftables forward policy and, only when required, a carefully scoped masquerade or source-NAT rule.

Host Naming and Naming Services

Linux name resolution is broader than DNS. Applications commonly use the Name Service Switch (NSS), configured in /etc/nsswitch.conf, to search local files, systemd-resolved, DNS, mDNS, LDAP/SSSD, and other databases. Use getent to test the same NSS path used by most applications instead of testing DNS alone.

Display and Configure the Host Name

$ hostnamectl status
$ hostname
$ hostname –fqdn
# hostnamectl set-hostname web01.example.com
$ cat /etc/hostname

Add a deliberate local mapping in /etc/hosts when required:

127.0.0.1 localhost
192.0.2.10 web01.example.com web01
$ getent hosts web01
$ getent ahosts web01.example.com

FQDN behaviour: hostname –fqdn depends on name service configuration and is not simply the text stored in /etc/hostname. Verify the returned address as well as the name.

Inspect Name Service Switch Order

$ grep -E “^(hosts|networks|passwd|group):” /etc/nsswitch.conf
$ getent hosts app.example.com
$ getent passwd alice

A common hosts line includes local files before a DNS-capable source, for example:

hosts: files systemd dns

Warning: Do not replace the hosts line blindly. Desktop discovery, mDNS, containers, LDAP, and local policy can require additional modules and ordering.

DNS Client Architecture

The resolver path can include an application, glibc NSS, /etc/resolv.conf, systemd-resolved, NetworkManager, a local caching resolver, and one or more upstream DNS servers. /etc/resolv.conf is frequently a symbolic link and may contain a local stub address rather than the upstream servers themselves.

Inspect DNS Configuration and Resolution

$ readlink -f /etc/resolv.conf
$ cat /etc/resolv.conf
$ resolvectl status
$ resolvectl dns
$ resolvectl domain
$ nmcli -f IP4.DNS,IP4.DOMAIN,IP6.DNS,IP6.DOMAIN device show enp1s0
$ getent ahosts app.example.com
$ dig app.example.com A
$ dig app.example.com AAAA

Query a specific DNS server and display delegation or trace information:

$ dig @192.0.2.53 app.example.com A +noall +answer
$ dig +trace example.com

getent versus dig: getent tests the system NSS path and can return /etc/hosts or LDAP results. dig queries DNS directly and is better for inspecting DNS flags, authority records, TTLs, and a specific server. Use both when their results differ.

Temporary DNS Settings with systemd-resolved

# resolvectl dns enp1s0 192.0.2.53 192.0.2.54
# resolvectl domain enp1s0 example.com
$ resolvectl status enp1s0
# resolvectl flush-caches
# resolvectl revert enp1s0

Configure split DNS so only corp.example.com is routed to the interface DNS servers:

# resolvectl dns enp1s0 192.0.2.53
# resolvectl domain enp1s0 “~corp.example.com”

Routing domain: The leading tilde marks a route-only domain. It selects a DNS link without appending the domain as a search suffix.

Persistent DNS with Netplan

network:
version: 2
ethernets:
    enp1s0:
      dhcp4: true
      dhcp4-overrides:
        use-dns: false
      nameservers:
        search: [example.com]
        addresses: [192.0.2.53, 192.0.2.54]
# netplan generate
# netplan try
$ resolvectl status enp1s0

Persistent DNS with NetworkManager

# nmcli connection modify server-lan \
ipv4.ignore-auto-dns yes \
ipv4.dns “192.0.2.53 192.0.2.54” \
ipv4.dns-search “example.com”
# nmcli connection up server-lan
$ nmcli -f IP4.DNS,IP4.DOMAIN device show enp1s0

Use DHCP-provided DNS again:

# nmcli connection modify server-lan ipv4.ignore-auto-dns no ipv4.dns “” ipv4.dns-search “”
# nmcli connection up server-lan

Persistent DNS with systemd-networkd

[Match]
Name=enp1s0

[Network]
DHCP=yes
DNS=192.0.2.53
DNS=192.0.2.54
Domains=example.com

[DHCPv4]
UseDNS=no
# networkctl reload
# networkctl reconfigure enp1s0
$ resolvectl status enp1s0

systemd-resolved Drop-In

A global fallback resolver can be configured in /etc/systemd/resolved.conf.d/10-site-dns.conf:

[Resolve]
FallbackDNS=192.0.2.53 192.0.2.54
DNSSEC=allow-downgrade
# systemctl restart systemd-resolved
$ resolvectl status

Warning: A global DNS= setting can bypass link-specific split-DNS design. Prefer per-link DNS from the interface manager when different networks use different namespaces.

DNS Troubleshooting Sequence

Resolve with getent to test the application NSS path.
Inspect /etc/nsswitch.conf and the /etc/resolv.conf symlink.
Inspect per-link servers and domains with resolvectl status.
Ping or route-check the numeric DNS server address.
Query the selected server directly with dig @server.
Capture UDP and TCP port 53 while repeating the query.
Check DNSSEC, VPN split-DNS, firewall, and MTU issues when replies are present but rejected.

$ getent ahosts app.example.com
$ resolvectl query app.example.com
$ ip route get 192.0.2.53
$ dig @192.0.2.53 app.example.com A +time=2 +tries=1
# tcpdump -ni enp1s0 port 53

NTP Client Configuration and Management

Accurate time is required for TLS certificate validation, Kerberos, distributed logs, databases, monitoring, and LDAP or other authentication workflows. Chrony is a full-featured NTP implementation commonly used on servers. systemd-timesyncd is a simpler SNTP/NTP client on installations that do not use chrony. Avoid running multiple time synchronisation daemons against the same clock.

Inspect Time Synchronisation State

$ timedatectl status
$ systemctl is-active chrony systemd-timesyncd
$ systemctl status chrony
$ systemctl status systemd-timesyncd

Configure Chrony

Install and enable chrony:

# apt update
# apt install -y chrony
# systemctl enable –now chrony

Example entries for /etc/chrony/chrony.conf:

pool ntp.ubuntu.com iburst maxsources 4
server ntp1.example.com iburst prefer
server ntp2.example.com iburst
makestep 1.0 3
rtcsync

Validate source selection, offset, frequency, and reachability:

# systemctl restart chrony
$ chronyc activity
$ chronyc sources -v
$ chronyc tracking
$ chronyc sourcestats -v

Step the clock immediately when policy permits:

# chronyc makestep

Warning: A backward or large time step can disrupt databases, clustered services, token validation, and log ordering. Review application requirements before forcing a step on a production system.

Configure systemd-timesyncd

Create /etc/systemd/timesyncd.conf.d/10-site.conf:

[Time]
NTP=ntp1.example.com ntp2.example.com
FallbackNTP=0.debian.pool.ntp.org 1.debian.pool.ntp.org
# systemctl disable –now chrony 2>/dev/null || true
# systemctl enable –now systemd-timesyncd
# timedatectl set-ntp true
$ timedatectl timesync-status
$ timedatectl show-timesync –all

Network requirements: An NTP client normally sends UDP to destination port 123. DNS must resolve named servers, and the firewall must permit the traffic. chronyc sources shows a reachability register that helps distinguish network failure from source rejection.

NTP Troubleshooting

$ getent ahosts ntp1.example.com
$ ip route get 192.0.2.123
$ chronyc sources -v
$ journalctl -b -u chrony
# tcpdump -ni enp1s0 udp port 123

A source marked with an asterisk is the selected chrony source; a question mark usually means it is not reachable or usable.
Large offsets can require time to slew unless makestep policy allows a step.
Virtual machines can also receive time from the hypervisor; avoid conflicting clock sources.
TLS and LDAP failures can be secondary symptoms of a clock that is outside certificate or ticket validity windows.

LDAP Client Configuration and Management

An LDAP client retrieves identity attributes such as users and groups and can authenticate through LDAP when designed to do so. On Debian and Ubuntu, SSSD provides caching, offline operation, NSS and PAM integration, access rules, and detailed diagnostics. Correct DNS, time synchronisation, certificate trust, and directory schema are prerequisites.

Warning: Do not send authentication credentials over unencrypted LDAP. Use StartTLS with ldap:// or use ldaps://, validate the server certificate, and restrict service-account secrets to root-readable files.

Test Directory Connectivity Before NSS/PAM Integration

Install query and SSSD tools:

# apt update
# apt install -y sssd-ldap sssd-tools ldap-utils libnss-sss libpam-sss

Test anonymous or permitted StartTLS access and the search base:

$ ldapsearch -x -H ldap://ldap01.example.com -ZZ \
-b “dc=example,dc=com” -s base namingContexts
$ openssl s_client -starttls ldap -connect ldap01.example.com:389 \
-servername ldap01.example.com </dev/null

Configure SSSD for LDAP

Example /etc/sssd/sssd.conf for an RFC 2307bis-style directory:

[sssd]
config_file_version = 2
services = nss, pam
domains = example.com

[domain/example.com]
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldap://ldap01.example.com, ldap://ldap02.example.com
ldap_search_base = dc=example,dc=com
ldap_schema = rfc2307bis
ldap_id_use_start_tls = true
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
cache_credentials = true
enumerate = false
use_fully_qualified_names = false
fallback_homedir = /home/%u
default_shell = /bin/bash

Protect, validate, and start SSSD:

# chown root:root /etc/sssd/sssd.conf
# chmod 600 /etc/sssd/sssd.conf
# sssctl config-check
# systemctl enable –now sssd
$ systemctl status sssd

Enable automatic home-directory creation when required by local policy:

# pam-auth-update –enable mkhomedir

Verify LDAP Identity and Authentication Paths

$ getent passwd alice
$ getent group engineering
$ id alice
$ sssctl user-checks alice
$ sssctl domain-status example.com

Clear cached records after a controlled directory change:

# sss_cache -u alice
# sss_cache -E

Warning: Clearing the entire cache removes offline identity data and can increase directory load. Clear only the affected entry when possible.

LDAP Logs and Troubleshooting

$ journalctl -b -u sssd # ls -l /var/log/sssd/ # tail -f /var/log/sssd/sssd_example.com.log $ sssctl config-check $ getent passwd alice $ ldapsearch -x -H ldap://ldap01.example.com -ZZ -b “dc=example,dc=com” “(uid=alice)”
Symptom	Common cause	Check
ldapsearch works, getent fails	NSS/SSSD configuration or cache	nsswitch.conf, sssd service, sssctl config-check, SSSD logs.
Certificate verify failed	Untrusted CA, wrong name, expired certificate, or wrong time	openssl s_client, CA bundle, timedatectl, server FQDN.
User resolves but login fails	PAM, bind/auth policy, access rule, or password control	sssctl user-checks, auth logs, PAM profile, directory policy.
Intermittent lookup delays	DNS, unreachable LDAP URI, referrals, or enumeration	DNS order, per-server reachability, enumerate=false, SSSD failover logs.
Offline login fails	Credentials never cached or cache expired	Perform one online login, cache_credentials, offline policy.

A lighter nslcd/libnss-ldapd client is available for simpler environments:

# apt install -y nslcd libnss-ldapd libpam-ldapd
$ systemctl status nslcd
$ getent passwd alice

Client choice: Use one coherent LDAP integration stack. Running SSSD and nslcd for the same NSS databases can create duplicate lookups and inconsistent caching.

NFS Client Configuration and Management

NFS mounts a server-exported file system into the local directory tree. NFSv4 normally uses TCP port 2049 and can integrate authentication, locking, and pseudo-filesystem exports more cleanly than older versions. The exact export path and security flavour are controlled by the server.

Install and Discover NFS Exports

# apt update
# apt install -y nfs-common
$ showmount -e nfs01.example.com
$ rpcinfo -p nfs01.example.com

NFSv4 discovery: showmount queries the older mount protocol and can be empty or blocked on a pure NFSv4 server even when NFSv4 mounts work. Confirm the server-exported NFSv4 path with the server administrator.

Mount and Unmount an NFS File System

# mkdir -p /mnt/projects
# mount -t nfs4 -o vers=4.2,proto=tcp nfs01.example.com:/projects /mnt/projects
$ findmnt /mnt/projects
$ nfsstat -m
# umount /mnt/projects

Test file access and the effective numeric ownership:

$ stat -f /mnt/projects
$ ls -ldn /mnt/projects
$ touch /mnt/projects/client-write-test && rm /mnt/projects/client-write-test

Persistent NFS Mount in /etc/fstab

An on-demand systemd automount avoids blocking boot while the network or server is unavailable:

nfs01.example.com:/projects /mnt/projects nfs4 rw,_netdev,nofail,x-systemd.automount,x-systemd.idle-timeout=600,vers=4.2,proto=tcp 0 0
# mkdir -p /mnt/projects
# systemctl daemon-reload
# mount -a
$ findmnt /mnt/projects
$ systemctl status mnt-projects.automount

Hard mounts: NFS hard-mount behaviour is normally preferred for data integrity because operations retry during an outage. Soft mounts can turn a network interruption into application I/O errors and possible data corruption. Use them only with a clear application-specific reason.

NFS Performance and Troubleshooting

$ nfsstat -m
$ nfsstat -c
$ nfsiostat 1
$ mountstats /mnt/projects
$ ss -tn dst nfs01.example.com:2049
# tcpdump -ni enp1s0 host nfs01.example.com and port 2049

Find processes preventing an unmount:

# fuser -vm /mnt/projects
# lsof +f — /mnt/projects
# umount /mnt/projects

Permission denied can mean the client is outside the export allow-list, the requested path is wrong, or the security flavour does not match.
Numeric UID/GID mismatches produce unexpected ownership even when networking is correct. Keep directory identity sources consistent.
Stale file handle errors normally require the server export or file identity to be corrected; remounting can clear the client state after the server issue is fixed.
For NFSv4 through a firewall, permit TCP 2049 from the required clients. Older NFS versions can require additional dynamic RPC services.

Built-in Firewalls and Network Security

The Linux kernel netfilter framework performs packet filtering, state tracking, NAT, and mangling. nftables is the modern native ruleset interface. UFW provides a simpler policy-oriented front end and is commonly used on Ubuntu. Check which tool already owns the rules before making changes; UFW can itself program nftables or iptables-compatible rules depending on the system.

Inspect Existing Firewall State

$ sudo ufw status verbose
# nft list ruleset
# iptables-save 2>/dev/null
$ ss -lntup

Listening versus permitted: A listening socket does not prove that traffic is allowed, and an allow rule does not prove that a service is listening. Check both the socket and the firewall path.

Enable a UFW Firewall Safely

Permit management SSH from the administration subnet before enabling a default-deny inbound policy:

# apt install -y ufw
# ufw default deny incoming
# ufw default allow outgoing
# ufw allow from 192.0.2.0/24 to any port 22 proto tcp comment “SSH management”
# ufw enable
# ufw status verbose

Warning: Enabling a firewall remotely without a tested management allow rule can lock you out. Keep the current session open and test a second connection before closing it.

List and Manage UFW Rules

# ufw status numbered
# ufw status verbose
# ufw show added
# ufw show raw
# ufw delete 3
# ufw delete allow 80/tcp
# ufw reload
# ufw disable

Warning: ufw reset removes user rules and returns UFW to an initial state. Export or record the rules before using it.

UFW Allow Examples

# ufw allow 80/tcp comment “HTTP”
# ufw allow 443/tcp comment “HTTPS”
# ufw allow from 192.0.2.0/24 to any port 2049 proto tcp comment “NFSv4 clients”
# ufw allow in on vlan100 from 198.51.100.0/24 to any port 5432 proto tcp
# ufw allow out to 192.0.2.53 port 53 proto udp
# ufw allow out to 192.0.2.53 port 53 proto tcp
# ufw limit 22/tcp comment “Rate-limit SSH”

Application profiles can group related ports:

$ ufw app list
$ ufw app info “OpenSSH”
# ufw allow “OpenSSH”

UFW Block Examples

# ufw deny from 198.51.100.50 comment “Blocked source”
# ufw deny 23/tcp comment “Block Telnet”
# ufw deny in on enp1s0 from 203.0.113.0/24 to any port 443 proto tcp
# ufw deny out to any port 25 proto tcp comment “Block direct SMTP”
# ufw reject from 198.51.100.60 to any port 22 proto tcp

deny versus reject: deny silently drops traffic. reject returns an error. Silent drops reveal less but take longer to diagnose; explicit rejects can be appropriate on trusted internal networks.

UFW Logging and IPv6

# ufw logging medium
# journalctl -f | grep –line-buffered UFW
# grep -i UFW /var/log/ufw.log 2>/dev/null

Confirm IPv6 policy in /etc/default/ufw and review both address families:

$ grep ^IPV6= /etc/default/ufw
# ufw status verbose

Warning: Do not secure only IPv4 while leaving globally routed IPv6 unfiltered. Also do not block all ICMPv6; neighbour discovery and path-MTU discovery depend on it.

Enable and Manage nftables

Install nftables, validate the persistent file, and enable the service:

# apt install -y nftables
# nft –check –file /etc/nftables.conf
# systemctl enable –now nftables
# nft list ruleset

Example /etc/nftables.conf with a default-deny input policy:

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    set management_v4 {
        type ipv4_addr
        flags interval
        elements = { 192.0.2.0/24 }
    }

chain input {
type filter hook input priority filter; policy drop;

        ct state invalid drop
        ct state established,related accept
        iifname “lo” accept

ip protocol icmp accept
ip6 nexthdr ipv6-icmp accept

        ip saddr @management_v4 tcp dport 22 ct state new \
            limit rate 15/minute accept
        tcp dport { 80, 443 } accept
        ip saddr 192.0.2.0/24 tcp dport 2049 accept

limit rate 5/second counter log prefix “nft-input-drop: ” drop
}

    chain forward {
        type filter hook forward priority filter; policy drop;
        ct state established,related accept
    }

    chain output {
        type filter hook output priority filter; policy accept;
    }
}
# nft –check –file /etc/nftables.conf
# nft –file /etc/nftables.conf
# systemctl restart nftables
# nft list ruleset

List, Add, and Delete nftables Rules

# nft list tables
# nft list table inet filter
# nft -a list chain inet filter input
# nft insert rule inet filter input ip saddr 198.51.100.50 counter drop
# nft insert rule inet filter input ip saddr 192.0.2.25 tcp dport 8443 counter accept

Delete a rule by the handle shown with nft -a:

# nft -a list chain inet filter input
# nft delete rule inet filter input handle 27

Rule order: nftables evaluates a base chain in order. Insert an exception before a broad terminal drop. Persist intentional changes in /etc/nftables.conf; interactive changes disappear when the ruleset is reloaded or the host reboots.

nftables Allow and Block Examples

# nft insert rule inet filter input iifname “vlan100” \
ip saddr 198.51.100.0/24 tcp dport 5432 ct state new accept
# nft insert rule inet filter input ip saddr 203.0.113.0/24 tcp dport 443 drop
# nft insert rule inet filter output ip daddr 198.51.100.25 tcp dport 25 reject
# nft insert rule inet filter input udp dport 51820 accept

Use counters to confirm that a rule matches traffic:

# nft -a list chain inet filter input
# watch -n 1 nft list chain inet filter input

Forwarding and NAT with nftables

Allow a private subnet to forward out enp1s0 and masquerade its IPv4 source addresses:

table inet filter {
    chain forward {
        type filter hook forward priority filter; policy drop;
        ct state established,related accept
        iifname “lan0” oifname “enp1s0” ip saddr 10.10.0.0/24 accept
    }
}

table ip nat {
    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
        oifname “enp1s0” ip saddr 10.10.0.0/24 masquerade
    }
}
# sysctl -w net.ipv4.ip_forward=1
# nft –check –file /etc/nftables.conf
# systemctl reload nftables

Warning: NAT can conceal routing mistakes and complicate auditing. Prefer ordinary routed prefixes where possible, and scope masquerade to the exact source network and egress interface.

Firewall Diagnostics

$ ss -lntup
$ ip route get 198.51.100.25
# nft monitor trace
# tcpdump -ni any host 198.51.100.25 and port 443
# journalctl -f | grep -E “UFW|nft-input-drop”

A packet seen on the inbound interface but not delivered to a listening socket points toward local filtering, policy routing, address binding, or reverse-path checks. A packet never seen locally points toward the upstream path, VLAN, switch, or remote sender.

Selected Kernel Security Controls

Inspect reverse-path filtering and source routing controls:

$ sysctl net.ipv4.conf.all.rp_filter
$ sysctl net.ipv4.conf.default.rp_filter
$ sysctl net.ipv4.conf.all.accept_source_route
$ sysctl net.ipv6.conf.all.accept_source_route

Example /etc/sysctl.d/60-network-security.conf for a simple single-path host:

net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

Warning: Strict rp_filter can break asymmetric routing, policy routing, some VPNs, and multihomed servers. Use loose mode 2 or disable it only after understanding the path and compensating firewall controls.

Traffic Flow, Bandwidth, and Resource Control

Linux traffic control, exposed through tc, manages queueing disciplines, shaping, scheduling, policing, delay, loss, and packet classification. Queueing normally acts on egress because the host controls when it transmits. Ingress shaping generally requires policing or redirecting traffic to an Intermediate Functional Block (IFB) device.

Inspect Queueing Disciplines and Traffic-Control Counters

$ tc qdisc show dev enp1s0
$ tc -s qdisc show dev enp1s0
$ tc class show dev enp1s0
$ tc filter show dev enp1s0

The statistics show bytes, packets, drops, overlimits, requeues, and backlog. Record the original qdisc before replacing it so the change can be reversed accurately.

Use Fair Queueing with Controlled Delay

Replace the root qdisc with fq_codel to provide per-flow fairness and control excessive queue delay:

# tc qdisc replace dev enp1s0 root fq_codel
$ tc -s qdisc show dev enp1s0

Remove the custom root qdisc and allow the default to be recreated:

# tc qdisc del dev enp1s0 root

Limit Egress Bandwidth with a Token Bucket Filter

Shape enp1s0 to approximately 100 Mbit/s:

# tc qdisc replace dev enp1s0 root tbf \
rate 100mbit burst 256kbit latency 50ms
$ tc -s qdisc show dev enp1s0

Remove the limit:

# tc qdisc del dev enp1s0 root

Shaping accuracy: The burst, latency, timer resolution, NIC offloads, and workload affect the observed rate. Measure with iperf3 and application traffic, not only with the configured value.

Classify Traffic with HTB

The following laboratory example creates a 100 Mbit/s parent, gives traffic to 198.51.100.0/24 a 60 Mbit/s guarantee, and places other traffic in a 10 Mbit/s default class that can borrow unused capacity:

# tc qdisc replace dev enp1s0 root handle 1: htb default 20
# tc class add dev enp1s0 parent 1: classid 1:1 htb rate 100mbit ceil 100mbit
# tc class add dev enp1s0 parent 1:1 classid 1:10 htb rate 60mbit ceil 100mbit prio 0
# tc class add dev enp1s0 parent 1:1 classid 1:20 htb rate 10mbit ceil 100mbit prio 1
# tc qdisc add dev enp1s0 parent 1:10 handle 10: fq_codel
# tc qdisc add dev enp1s0 parent 1:20 handle 20: fq_codel
# tc filter add dev enp1s0 protocol ip parent 1: prio 1 u32 \
match ip dst 198.51.100.0/24 flowid 1:10
$ tc -s class show dev enp1s0
# tc qdisc del dev enp1s0 root

Warning: A tc syntax or classification error can degrade all traffic on the interface. Test in a lab, retain a removal command, and make production changes from console access.

Emulate Delay, Loss, and Reordering for Testing

netem is useful for controlled application testing, not as a production fix:

# tc qdisc replace dev enp1s0 root netem delay 50ms 10ms loss 0.5%
$ tc -s qdisc show dev enp1s0
# tc qdisc del dev enp1s0 root

Warning: Always remove netem after the test. An abandoned impairment rule can look like a real network incident.

Measure Throughput with iperf3

Start a test server on one endpoint:

$ iperf3 -s

Run forward, reverse, parallel, and UDP tests from the client:

$ iperf3 -c 198.51.100.20
$ iperf3 -c 198.51.100.20 -R
$ iperf3 -c 198.51.100.20 -P 8
$ iperf3 -c 198.51.100.20 -u -b 100M -t 20

Test design: iperf3 measures the endpoints and path under the selected protocol and stream count. CPU, encryption, window size, NIC offloads, disk I/O, Wi-Fi airtime, and other traffic can all limit results.

Per-Service Network Accounting and Address Restrictions

systemd can account IP traffic for a service and, on supported systems, enforce address allow/deny controls. Create a service drop-in with systemctl edit example.service:

[Service]
IPAccounting=yes
IPAddressDeny=any
IPAddressAllow=192.0.2.53
IPAddressAllow=192.0.2.54
IPAddressAllow=127.0.0.0/8
IPAddressAllow=::1/128
# systemctl daemon-reload
# systemctl restart example.service
$ systemctl show example.service \
-p IPAccounting -p IPIngressBytes -p IPIngressPackets \
-p IPEgressBytes -p IPEgressPackets

Warning: IPAddressAllow and IPAddressDeny can prevent a service from reaching dependencies such as DNS, NTP, package repositories, proxies, or databases. Apply them only after mapping all required destinations and confirming kernel/cgroup support.

Network Namespace Isolation Example

A network namespace has its own interfaces, routes, neighbours, firewall state, and sockets. Create a small isolated namespace connected by a veth pair:

# ip netns add lab
# ip link add veth-host type veth peer name veth-lab
# ip link set veth-lab netns lab
# ip address add 10.10.0.1/24 dev veth-host
# ip link set veth-host up
# ip netns exec lab ip address add 10.10.0.2/24 dev veth-lab
# ip netns exec lab ip link set lo up
# ip netns exec lab ip link set veth-lab up
# ip netns exec lab ip route add default via 10.10.0.1
# ip netns exec lab ping -c 3 10.10.0.1

Remove the laboratory namespace and its veth pair:

# ip netns delete lab
# ip link delete veth-host 2>/dev/null || true

Monitoring Traffic on an Interface

Interface Counters

$ ip -s link show dev enp1s0
$ cat /proc/net/dev
$ ethtool -S enp1s0
$ watch -n 1 “ip -s link show dev enp1s0”

Important counters include receive/transmit bytes and packets, errors, dropped packets, missed packets, overruns, carrier errors, collisions, and driver-specific CRC or queue counters. Compare the rate of change rather than relying only on the absolute value.

Interactive Bandwidth Tools

# apt install -y nload iftop bmon vnstat
# nload enp1s0
# iftop -i enp1s0 -n -P
# bmon -p enp1s0
# systemctl enable –now vnstat
$ vnstat -i enp1s0
$ vnstat -i enp1s0 –days

Permissions: Tools that inspect packet headers can require root or packet-capture capabilities. Run with the least privilege required and protect any captured data.

Packet Capture with tcpdump

Capture all packets on an interface without resolving names or ports:

# tcpdump -ni enp1s0 -nn

Useful filters:

# tcpdump -ni enp1s0 host 198.51.100.25
# tcpdump -ni enp1s0 tcp port 443
# tcpdump -ni enp1s0 udp port 53
# tcpdump -eni enp1s0 vlan 100
# tcpdump -ni enp1s0 “arp or icmp or icmp6”
# tcpdump -ni enp1s0 “tcp[tcpflags] & (tcp-syn|tcp-rst|tcp-fin) != 0”

Write a bounded rotating capture for later Wireshark analysis:

# tcpdump -ni enp1s0 -s 0 -C 100 -W 5 \
-w /var/tmp/enp1s0-capture.pcap

Warning: Packet captures can contain credentials, session tokens, personal data, and confidential payloads. Limit the interface, hosts, ports, duration, and file access; delete captures according to policy.

Monitor Sockets and TCP Health

$ ss -s
$ ss -lntup
$ ss -tnp state established
$ ss -ti dst 198.51.100.25
$ nstat -az
$ watch -n 1 “ss -s”

ss -ti can display congestion-control state, round-trip time, retransmissions, congestion window, pacing rate, and bytes in flight for TCP sockets. nstat exposes protocol counters such as retransmitted segments and ICMP errors.

Collect Performance Metrics with sysstat

# apt install -y sysstat # systemctl enable –now sysstat $ sar -n DEV 1 10 $ sar -n EDEV 1 10 $ sar -n TCP,ETCP 1 10 $ sar -n SOCK 1 10
Metric view	What it helps identify
sar -n DEV	Packets and throughput per interface.
sar -n EDEV	Receive/transmit errors, drops, FIFO issues, carrier errors, and collisions.
sar -n TCP	Active/passive opens, segments, and TCP connection behaviour.
sar -n ETCP	Retransmissions and TCP failures.
ethtool -S	NIC and driver-specific queue, CRC, pause, and hardware counters.
ss -ti	Per-connection RTT, retransmission, congestion, and window details.
tc -s qdisc	Queue drops, backlog, overlimits, and shaping activity.
vnstat	Longer-term interface byte totals independent of packet payload capture.

Create a Simple Baseline

Collect the same measurements during a healthy period and an incident:

$ date -Is
$ ip -s link show dev enp1s0
$ ethtool enp1s0
$ ethtool -S enp1s0
$ ss -s
$ nstat -az
$ sar -n DEV,EDEV,TCP,ETCP 1 10
$ tc -s qdisc show dev enp1s0

Rate and correlation: One counter is rarely conclusive. Correlate interface errors, TCP retransmissions, queue drops, application latency, CPU load, and timestamps with switch and remote endpoint metrics.

Troubleshooting Workflow

Troubleshooting should produce evidence at each layer rather than a sequence of speculative configuration changes. Record the time, interface, source and destination, protocol, port, expected path, and whether the problem affects one host, one VLAN, one application, or the entire system.

Step-by-Step Network Troubleshooting

Confirm the symptom with an exact command and record the timestamp.
Identify the interface owner: Netplan/backend, NetworkManager, systemd-networkd, or ifupdown.
Check hardware detection, driver, administrative state, carrier, speed, duplex, MTU, and errors.
Check the expected address and prefix, including duplicate-address state and DHCP lease details.
Check ARP or IPv6 neighbour state to the local gateway or peer.
Check route selection with ip route get, including source address and policy tables.
Test numeric reachability before DNS; then test NSS and direct DNS independently.
Check the local and remote listening socket and the relevant firewall direction.
Use traceroute/tracepath to identify the last responding hop and possible MTU changes.
Capture packets at the closest useful interface and correlate the trace with service and kernel logs.
Compare counters and performance metrics with a known-good baseline.
Make one controlled change, retest, and either keep or roll it back.

ping – Reachability, Latency, and Loss

ping sends ICMP echo requests and reports replies, loss, and round-trip time. Some networks filter echo, so a failed ping does not by itself prove the destination application is unavailable.

$ ping -c 4 192.0.2.1
$ ping -4 -c 4 app.example.com
$ ping -6 -c 4 2001:db8:1::20
$ ping -c 4 -I enp1s0 198.51.100.25
$ ping -c 4 -W 2 198.51.100.25
$ ping -D -c 4 198.51.100.25

Test path MTU and prevent IPv4 fragmentation:

$ ping -c 3 -M do -s 1472 198.51.100.25 $ ping -c 3 -M do -s 1400 198.51.100.25
Observation	Interpretation
Local gateway does not reply	Investigate link, VLAN, address/prefix, ARP, switch, or gateway filtering.
Gateway replies; remote IP does not	Investigate routing, upstream filtering, remote host, or return path.
Remote IP replies; name fails	Investigate NSS/DNS rather than general IP connectivity.
Small payload works; large DF payload fails	Suspect path-MTU discovery or an MTU mismatch.
Variable high RTT and loss	Check congestion, Wi-Fi quality, queueing, duplex/errors, and remote load.

arp, ip neighbour, and arping

ARP maps IPv4 addresses to MAC addresses on the local link. The legacy arp command can display the cache, but ip neighbour is the preferred interface and also covers IPv6 neighbour discovery.

$ arp -n
$ ip neighbour show
$ ip neighbour show dev enp1s0
$ ip -6 neighbour show dev enp1s0

Delete or flush stale neighbour entries:

# ip neighbour del 192.0.2.1 dev enp1s0
# ip neighbour flush dev enp1s0 nud failed
# arp -d 192.0.2.1

Probe a peer or check a candidate address:

# arping -I enp1s0 -c 4 192.0.2.1 # arping -D -I enp1s0 -c 3 192.0.2.10
Neighbour state	Meaning
REACHABLE	Recently confirmed as reachable.
STALE	Entry is valid but has not been recently confirmed; normal until used.
DELAY / PROBE	Kernel is actively confirming reachability.
INCOMPLETE	Resolution request sent; no MAC learned yet.
FAILED	Resolution attempts failed. Check subnet, VLAN, peer, and switch path.
PERMANENT	Static neighbour entry; kernel does not age it normally.

traceroute and tracepath – Path Discovery

traceroute sends probes with increasing TTL or hop-limit values. Routers can filter or rate-limit the resulting ICMP replies, so asterisks do not always indicate packet loss for real application traffic.

$ traceroute -n 198.51.100.25
$ traceroute -I -n 198.51.100.25
$ traceroute -T -p 443 -n 198.51.100.25
$ traceroute -6 -n 2001:db8:2::25
$ tracepath 198.51.100.25
$ tracepath6 2001:db8:2::25

Use numeric output first to prevent slow or misleading reverse-DNS lookups.
TCP probes to the application port can traverse paths that filter classic UDP traceroute.
tracepath reports discovered path MTU and usually does not require root.
Compare forward and return paths when asymmetric routing is possible; a local trace shows only one direction.

nc – TCP and UDP Port Testing

netcat opens TCP or UDP connections and can create a simple listener. It is a diagnostic tool, not an encrypted or authenticated application protocol.

$ nc -vz -w 3 app.example.com 443
$ nc -vz -w 3 198.51.100.20 20-25
$ nc -vzu -w 3 192.0.2.53 53

Create a temporary TCP listener on one host and connect from another:

# nc -l 9000
$ printf “network test\n” | nc -N 198.51.100.20 9000

For a UDP listener and sender:

# nc -u -l 9000
$ printf “udp test\n” | nc -u -w 1 198.51.100.20 9000

Warning: A netcat listener exposes a raw unauthenticated port. Bind only on a controlled test network, add temporary firewall scope, and stop it immediately after testing.

ss – Socket and Connection Inspection

$ ss -lntup
$ ss -ltn sport = :443
$ ss -tnp dst 198.51.100.25
$ ss -tan state syn-sent
$ ss -tan state time-wait
$ ss -ti
$ ss -s

A large SYN-SENT population suggests unanswered connection attempts. A listener bound only to 127.0.0.1 will not accept connections to the external interface. A listener on 0.0.0.0 or [::] can accept on multiple addresses subject to application and firewall policy.

dig, getent, and resolvectl – Name Resolution

$ getent ahosts app.example.com
$ resolvectl query app.example.com
$ dig app.example.com A +noall +answer
$ dig app.example.com AAAA +noall +answer
$ dig @192.0.2.53 app.example.com A +time=2 +tries=1
$ dig -x 192.0.2.20

Inspect DNS response codes and flags:

$ dig @192.0.2.53 app.example.com A +comments +answer +authority

tcpdump – Packet-Level Evidence

A healthy TCP connection begins with SYN, SYN-ACK, ACK. Repeated SYN packets with no SYN-ACK suggest filtering, routing, or an unavailable destination. An immediate RST normally means the host is reachable but the port is closed or actively rejected.

# tcpdump -ni enp1s0 -nn “host 198.51.100.25 and tcp port 443”

Observe ARP, DHCP, DNS, and ICMP separately:

# tcpdump -eni enp1s0 arp
# tcpdump -ni enp1s0 -vvv “udp port 67 or udp port 68”
# tcpdump -ni enp1s0 -vvv port 53
# tcpdump -ni enp1s0 -vvv “icmp or icmp6”

Capture traffic for one VLAN and verify the tag at the parent interface:

# tcpdump -eni enp1s0 vlan 100
# tcpdump -ni vlan100 host 192.0.2.1

curl and Application-Layer Testing

$ curl -v –connect-timeout 5 https://app.example.com/
$ curl -4 -v https://app.example.com/
$ curl -6 -v https://app.example.com/
$ curl -v –resolve app.example.com:443:192.0.2.20 https://app.example.com/

–resolve: curl –resolve separates DNS from the rest of the HTTPS test by forcing one address while retaining the original host name for HTTP Host and TLS SNI.

Optional mtr Continuous Path Testing

# apt install -y mtr-tiny
$ mtr -rwzc 50 198.51.100.25
$ mtr -T -P 443 -rwzc 50 app.example.com

Warning: Intermediate routers can deprioritise mtr replies while forwarding real traffic normally. Loss at one hop is significant only when it continues to later hops or correlates with endpoint loss.

Troubleshooting Common Scenarios

Interface Missing

Check hardware visibility, driver binding, firmware errors, disabled BIOS/UEFI devices, and predictable-name changes. Compare lspci with /sys/class/net to determine whether hardware exists without an interface.

Interface Present but No Carrier

$ ip -br link show enp1s0
$ ethtool enp1s0
$ cat /sys/class/net/enp1s0/carrier
$ journalctl -k -b | grep -i enp1s0

Verify cable/optic, switch port, speed negotiation, transceiver compatibility, radio block, and that the correct physical port corresponds to the Linux name.

DHCP Does Not Obtain an Address

$ ip -br link show enp1s0
$ ip -br address show enp1s0
$ journalctl -b -u NetworkManager | grep -i dhcp
$ journalctl -b -u systemd-networkd | grep -i dhcp
# tcpdump -eni enp1s0 -vvv “udp port 67 or udp port 68”

A DHCPDISCOVER with no DHCPOFFER points toward VLAN, switch relay, server scope, or path filtering. An OFFER without a completed ACK can indicate policy, duplicate addresses, or client/server state mismatch.

Local Subnet Peer Is Unreachable

$ ip address show dev enp1s0
$ ip route get 192.0.2.20
$ ip neigh show 192.0.2.20
# arping -I enp1s0 -c 4 192.0.2.20
# tcpdump -eni enp1s0 arp

Focus on prefix length, VLAN, ARP, bridge/bond membership, peer state, duplicate addresses, and local firewall. A gateway is not normally involved for peers in the same prefix.

Internet Works by Address but Not by Name

$ ping -c 3 198.51.100.25
$ getent ahosts app.example.com
$ resolvectl status
$ dig @192.0.2.53 app.example.com A
# tcpdump -ni enp1s0 port 53

Inspect the resolv.conf symlink, per-link DNS server, route to that server, search domains, DNSSEC status, VPN split-DNS, and UDP/TCP port 53 filtering.

Remote Service Is Unreachable

$ ip route get 198.51.100.20
$ nc -vz -w 3 198.51.100.20 443
$ traceroute -T -p 443 -n 198.51.100.20
# tcpdump -ni enp1s0 host 198.51.100.20 and tcp port 443

On the server, confirm the listening address, process, local firewall, and service logs:

$ ss -ltnp sport = :443
# nft list ruleset
$ systemctl status nginx
$ journalctl -b -u nginx

Intermittent Freezes or MTU Black Hole

$ tracepath 198.51.100.25
$ ping -M do -s 1472 -c 3 198.51.100.25
$ ping -M do -s 1400 -c 3 198.51.100.25
# tcpdump -ni enp1s0 “icmp or icmp6 or host 198.51.100.25”

Look for ICMP fragmentation-needed or ICMPv6 packet-too-big messages, TCP retransmissions after larger packets, VPN/tunnel overhead, and inconsistent jumbo-frame settings.

Slow Throughput

$ ethtool enp1s0
$ ip -s link show enp1s0
$ ethtool -S enp1s0
$ ss -ti dst 198.51.100.20
$ sar -n DEV,EDEV,TCP,ETCP 1 10
$ iperf3 -c 198.51.100.20 -P 4

Check negotiated speed/duplex, CRC and pause counters, packet loss, retransmissions, qdisc drops, Wi-Fi signal/airtime, CPU saturation, encryption, application limits, and whether one LACP flow is constrained to a single member.

VLAN Traffic Fails

$ ip -d link show vlan100
$ ip address show vlan100
$ ip route get 192.0.2.1
# tcpdump -eni enp1s0 vlan 100
# tcpdump -ni vlan100 arp or icmp

Confirm parent state, VLAN ID, tagged versus untagged switch configuration, allowed VLAN list, native VLAN, bridge VLAN filtering, and address placement.

Bond or LACP Fails Over Incorrectly

$ cat /proc/net/bonding/bond0
$ ip -s -d link show bond0
$ ethtool enp1s0
$ ethtool enp2s0
# tcpdump -eni enp1s0 ether proto 0x8809
# tcpdump -eni enp2s0 ether proto 0x8809

For active-backup, check the active member, MII state, primary policy, MAC movement, and gratuitous ARP. For LACP, check actor/partner state, aggregator IDs, switch port-channel membership, VLAN parity, and multi-chassis support.

Common Errors and Focused Fixes

Problem	Likely explanation	Focused action
Network is unreachable	No matching route or interface has no usable address.	ip route get; inspect address, link route, and default route.
Destination Host Unreachable from local host	Neighbour resolution or local route failed.	ip neigh, arping, VLAN, prefix, peer state.
Connection refused	Destination replied with TCP RST or firewall reject.	Check server listener, bind address, service status, reject rules.
Connection timeout	Silent drop, route failure, loss, or application not responding.	tcpdump both ends, traceroute TCP, firewall and return path.
RTNETLINK: File exists	Conflicting existing object.	ip address/route/rule show; remove exact duplicate or use replace.
Temporary failure in name resolution	Resolver unavailable or misconfigured.	getent, resolvectl, resolv.conf symlink, dig @server.
Address already in use	Duplicate address or local bind conflict.	arping -D, ip address, ss -lntup, address inventory.
No such device	Wrong/renamed interface or missing driver.	ip link, udevadm, lspci -k, kernel logs.
Operation not supported	Driver/hardware lacks requested feature.	ethtool -i/-k, kernel/driver docs, alternate mode.
Netplan rollback or apply failure	YAML/backend conflict or remote confirmation timeout.	netplan generate –debug, journal, one manager per interface.
NFS server not responding	Path, firewall, DNS, route, or server outage.	getent, nc 2049, mount -v, nfsstat, capture.
LDAP certificate verify failed	CA/name/time mismatch.	openssl s_client, CA trust, DNS name, timedatectl.

Collect a Network Diagnostic Snapshot

The following example creates a text bundle without packet payloads. Review it for secrets and internal details before sharing:

# out=/var/tmp/netdiag-$(date +%F-%H%M%S)
# mkdir -m 700 “$out”
# uname -a >”$out/uname.txt”
# ip -br link >”$out/ip-link.txt”
# ip -br address >”$out/ip-address.txt”
# ip -s -d link >”$out/ip-link-detail.txt”
# ip route show table all >”$out/ip-route-all.txt”
# ip -6 route show table all >”$out/ip6-route-all.txt”
# ip rule show >”$out/ip-rule.txt”
# ip neigh show >”$out/ip-neigh.txt”
# ss -lntup >”$out/ss-listen.txt”
# ss -s >”$out/ss-summary.txt”
# resolvectl status >”$out/resolvectl.txt” 2>&1 || true
# nmcli device show >”$out/nmcli-device.txt” 2>&1 || true
# networkctl status –all >”$out/networkctl.txt” 2>&1 || true
# nft list ruleset >”$out/nftables.txt” 2>&1 || true
# journalctl -b -k >”$out/kernel-journal.txt”
# journalctl -b -u NetworkManager -u systemd-networkd \
-u systemd-resolved >”$out/network-services.txt”
# tar -C /var/tmp -czf “$out.tar.gz” “${out##*/}”
# echo “$out.tar.gz”

Warning: Diagnostic bundles can expose addresses, routes, DNS domains, firewall policy, process names, and host identifiers. Store and transfer them securely.

Command Reference Summary

Task	Command
List interfaces and addresses	ip -br link; ip -br address
Show detailed interface state	ip -s -d link show dev enp1s0
Show Ethernet link and driver	ethtool enp1s0; ethtool -i enp1s0
Show wireless state	iw dev; iw dev wlp2s0 link; rfkill list
Show MAC address	ip link show enp1s0; ethtool -P enp1s0
Temporary address add/delete	ip addr add PREFIX dev IFACE; ip addr del PREFIX dev IFACE
List routes and rules	ip route; ip -6 route; ip rule
Explain route choice	ip route get DEST from SOURCE
Add/replace default route	ip route replace default via GATEWAY dev IFACE metric N
Add/delete static route	ip route add PREFIX via GATEWAY; ip route del PREFIX via GATEWAY
Show neighbours	ip neigh show; ip -6 neigh show
Test duplicate IPv4 address	arping -D -I IFACE -c 3 ADDRESS
List listening sockets	ss -lntup
Test TCP port	nc -vz -w 3 HOST PORT
Trace TCP path	traceroute -T -p PORT -n HOST
Check path MTU	tracepath HOST; ping -M do -s SIZE HOST
DNS through NSS	getent ahosts NAME
Direct DNS query	dig @SERVER NAME TYPE
Resolver status	resolvectl status
Capture packets	tcpdump -ni IFACE FILTER
Netplan validate/test	netplan generate; netplan try; netplan status –all
NetworkManager profiles	nmcli con show; nmcli dev status
networkd state	networkctl list; networkctl status IFACE
Bond state	cat /proc/net/bonding/bond0
VLAN details	ip -d link show type vlan
UFW rules	ufw status numbered
nftables rules	nft -a list ruleset
Interface metrics	ip -s link; ethtool -S IFACE; sar -n DEV,EDEV 1
TCP metrics	ss -ti; nstat -az; sar -n TCP,ETCP 1
Queue metrics	tc -s qdisc show dev IFACE
NTP status	chronyc tracking; chronyc sources -v; timedatectl
LDAP identity test	getent passwd USER; id USER; sssctl user-checks USER
NFS mount state	findmnt; nfsstat -m; nfsiostat 1
Follow network logs	journalctl -f -u NetworkManager -u systemd-networkd

Quick Layer-to-Tool Reference

Layer or service	Inspect	Configure or manage
Physical Ethernet	lspci, lshw, ethtool, journalctl -k	ethtool -s, .link, driver/module settings
Wireless physical/link	iw phy, iw dev, rfkill, nmcli wifi	nmcli, Netplan, iw/rfkill for temporary state
Data link	ip -s -d link, bridge, ip neigh	ip link, bridge, Netplan/NM/networkd/ifupdown
VLAN	ip -d link, bridge vlan, tcpdump -e	ip link type vlan, Netplan/NM/.netdev/interfaces
Bond/LACP	/proc/net/bonding, ip -d link	Netplan/NM/.netdev/ifupdown plus switch LAG
IPv4/IPv6 address	ip address, manager status	ip address, persistent manager profile
Routing	ip route, ip rule, ip route get	ip route/rule, persistent routes and policies
TCP/UDP	ss, nc, tcpdump, nstat	Application bind, firewall, sysctl, tc
DNS	getent, resolvectl, dig	Netplan/NM/networkd, resolved, NSS, hosts
NTP	timedatectl, chronyc	chrony.conf or timesyncd drop-in
LDAP	ldapsearch, getent, id, sssctl	sssd.conf, PAM/NSS, CA trust
NFS	findmnt, nfsstat, nfsiostat, tcpdump	mount, fstab, systemd automount
Firewall	ufw status, nft list ruleset, counters/logs	ufw commands or /etc/nftables.conf
Performance	sar, ethtool -S, ss -ti, tc -s, iperf3	tc, qdisc/classes, service IP accounting

Final Notes

Debian and Ubuntu networking is easiest to manage when each interface has one configuration owner, temporary tests are clearly separated from persistent changes, and troubleshooting follows the stack from hardware to application. Save a known-good configuration, keep console recovery available for routing and firewall changes, and validate both IPv4 and IPv6 where they are enabled.

The most valuable operational habit is to capture evidence before changing state: link negotiation, addresses, neighbour entries, route selection, DNS source, listening sockets, firewall counters, packet traces, and time-correlated logs. That evidence distinguishes a local configuration problem from an upstream path or remote service failure and makes the final fix repeatable.

Authoritative References

The following official project and distribution documentation provides current syntax, option definitions, and release-specific detail. Package versions and defaults can differ between Debian and Ubuntu releases, so check the local man pages as well as these references.

Ubuntu Server: Configuring networks – Netplan-based address, route, bridge, bond, and VLAN configuration.
Netplan YAML configuration reference – Complete schema for interfaces, routes, policy routing, VLANs, bridges, and bonds.
Netplan CLI reference – generate, apply, try, get, set, and status operations.
Debian Reference – Chapter 5: Network setup – Debian network configuration, naming, and troubleshooting overview.
NetworkManager nmcli examples – Official profile, Ethernet, bridge, bond, and IP examples.
NetworkManager settings reference – Ethernet autonegotiation, speed, duplex, and related profile properties.
systemd.network manual – systemd-networkd addresses, routes, DHCP, DNS, and virtual-device attachment.
systemd.netdev manual – Bonds, bridges, VLANs, tunnels, and other virtual devices.
systemd.link manual – Persistent link naming and hardware properties.
Linux kernel networking documentation – Kernel interfaces, drivers, bonding, scaling, and networking internals.
Ubuntu Server: Firewall and UFW – UFW installation, enablement, rule syntax, and logging.
nftables project wiki – Ruleset concepts, tables, chains, sets, NAT, and troubleshooting.
Chrony documentation – chronyd and chronyc configuration and diagnostics.
Ubuntu Server: SSSD with LDAP – LDAP client setup with SSSD, TLS, NSS, and PAM.
Ubuntu Server: Network File System (NFS) – NFS client/server installation and mount examples.
Debian manpages – Release-specific manuals for ip, ss, ethtool, nft, interfaces, systemd, and service tools.

Check out our other Cheat Sheets and Blogs and if you would like us to write a cheat sheet for you, for FREE, (and we find it suitable) Contact Us.

Debian and Ubuntu Linux Networking Cheat Sheet

Debian and Ubuntu Linux Networking Cheat Sheet and Guide

General Description of Linux Networking

Safety, Conventions, and Example Addresses

Contents

Built-in Utilities and Commonly Installed Tools

Core Utilities Normally Available

Common Packages to Install

Modern Replacements for Legacy Commands

Networking Layers and Layer-Specific Commands

Physical Layer

Data-Link Layer

IP, ICMP, and Routing Layer

TCP and UDP Transport Layer

A Layered Test Sequence

Management of Network and Networking Services

Identify the Active Configuration Stack

systemd Service Management

Netplan Management

NetworkManager Management

systemd-networkd Management

ifupdown Management

Management of Networking Configuration Files

Safe Editing and Validation

Errors, Logs, and Event Monitoring

General and Kernel Logs

Manager and Service Logs

Live Link, Address, and Route Events

Common Error Messages and Their Layer

Interface Discovery and Link Management

Discover All Interfaces

Distinguish Physical and Virtual Interfaces

Discover Wireless Interfaces

Find the MAC Address

Find Advanced Interface Properties

Find Link Speed and Duplex

Configure Fixed or Automatic Link Speed

Administrative State, MTU, and Queue State

Configure Virtual Interfaces

Dummy Interface

Virtual Ethernet Pair

Bridge Interface

Macvlan Interface

Static and DHCP IP Addressing

Inspect Current Addresses and Address Metadata

Temporary Static IPv4 Address – Add, Change, and Delete

Temporary Static IPv6 Address

Persistent Static Address with Netplan

Persistent Static Address with NetworkManager

Persistent Static Address with systemd-networkd

Persistent Static Address with ifupdown

Configure DHCP with Netplan

Configure DHCP with NetworkManager

Configure DHCP with systemd-networkd

Configure DHCP with ifupdown

Verify a DHCP Lease

Duplicate-Address Checks

VLANs and IEEE 802.1Q Tagging

Temporary VLAN Interface

Persistent VLAN with Netplan

Persistent VLAN with NetworkManager

Persistent VLAN with systemd-networkd

Persistent VLAN with ifupdown

VLAN Verification and Troubleshooting

Failover IP Address over Two Interfaces

Active-Backup Bond with Netplan

Active-Backup Bond with NetworkManager

Active-Backup Bond with systemd-networkd

Active-Backup Bond with ifupdown

Test Active-Backup Failover

LACP / IEEE 802.3ad Aggregation

LACP Bond with Netplan

LACP Bond with NetworkManager

LACP Bond with systemd-networkd

LACP Bond with ifupdown

Verify LACP State and Distribution

Routing

List All Routes and Rules

Temporary Default Route – Add, Change, and Delete

Temporary Static Route – Add, Change, and Delete