Red Hat Enterprise Linux and Oracle Linux Networking Cheat Sheet and Guide
General Description of Linux Networking
Linux networking is the combination of kernel protocol stacks, network-device drivers, interface objects, routing tables, packet filters, user-space services, configuration profiles, and diagnostic utilities that allow a Red Hat Enterprise Linux or Oracle Linux system to communicate on local and remote networks.
A reliable administrator works from the lowest layer upward. First confirm that the adapter and driver exist. Then confirm carrier, speed, duplex, MTU, MAC address, VLAN and bond state. Only after the data-link layer is sound should you investigate IP addressing, neighbours, routes, DNS, transport ports, firewall policy, and application behaviour.
Typical administration tasks include:
- Discovering wired, wireless, physical, virtual, bridge, VLAN, and bond interfaces.
- Assigning static or DHCP-provided IPv4 and IPv6 addresses.
- Configuring gateways, static routes, routing rules, DNS servers, and search domains.
- Creating VLANs, virtual interfaces, active-backup bonds, and IEEE 802.3ad LACP bonds.
- Managing host naming, time synchronisation, LDAP identity lookups, and NFS mounts.
- Controlling traffic with firewalld, native nftables, SELinux network policy, and Linux traffic control.
- Monitoring link counters, sockets, packet flows, latency, loss, retransmissions, and throughput.
- Collecting logs, state snapshots, and packet captures for repeatable troubleshooting.
NetworkManager is the normal persistent network configuration service on current Red Hat Enterprise Linux and Oracle Linux releases. The nmcli command is the primary command-line interface; nmtui, Cockpit, the Nmstate API, and configuration automation are alternative front ends. The kernel-facing ip, ss, bridge, tc, ethtool, iw, and nft utilities remain essential because they display or change the actual running state.
This guide focuses on Red Hat Enterprise Linux 8, 9, and 10 and Oracle Linux 8, 9, and 10. It explicitly marks legacy ifcfg examples that are appropriate only for older or transitional systems. RHEL 10 and Oracle Linux 10 use NetworkManager keyfile profiles and do not support legacy ifcfg profiles.
Oracle Linux can run the Unbreakable Enterprise Kernel or the Red Hat Compatible Kernel. User-space tools and NetworkManager workflows are largely the same, but driver capabilities, offloads, queue counts, and performance counters can differ by kernel and hardware.
Safety, Version Scope, Conventions, and Example Addresses
Warning: Changing an interface, address, default route, VLAN, bond, DNS setting, or firewall zone over the same SSH session can disconnect you. Keep console, hypervisor console, serial console, or other out-of-band access available. Record the working configuration before changing it and keep a second privileged session open while testing.
Command prompts used in this guide:
|
$ command # Run as an ordinary user |
Documentation-only example values are used throughout:
|
Purpose |
Example |
|
Primary IPv4 LAN |
192.0.2.0/24 |
|
Second IPv4 network |
198.51.100.0/24 |
|
Third IPv4 network |
203.0.113.0/24 |
|
IPv6 documentation prefix |
2001:db8::/32 |
|
Wired interfaces |
enp1s0 and enp2s0 |
|
Wireless interface |
wlp2s0 |
|
Bond interface |
bond0 |
|
VLAN interface |
vlan100 |
Replace every interface name, connection profile name, address, gateway, DNS server, route, VLAN identifier, firewall zone, and service port with values appropriate to the system being managed.
Before a remote change, capture the current state:
|
# stamp=$(date +%F-%H%M%S) |
Prefer changing a single NetworkManager profile and reapplying it instead of restarting all networking:
|
# nmcli connection show |
nmcli device reapply applies many changed properties without a full disconnect, but not every property is re-applicable. If activation is required, use a console or schedule an automatic rollback command before bringing the profile up.
Contents
- Built-in utilities and commonly installed tools
- Networking layers and layer-specific commands
- NetworkManager and networking service management
- Networking configuration files and version differences
- Errors, logs, and event monitoring
- Interface discovery and link management
- Static and DHCP IP addressing
- VLANs and IEEE 802.1Q tagging
- Failover IP addressing with active-backup bonding
- LACP / IEEE 802.3ad aggregation
- Routing and policy routing
- Host naming and name service switch configuration
- DNS client configuration and management
- NTP client configuration and management
- LDAP client configuration and management
- NFS client configuration and management
- firewalld, nftables, SELinux, and network security
- Traffic flow, bandwidth, and resource control
- Traffic monitoring and performance metrics
- Troubleshooting tools and layered workflows
- Command reference and authoritative references
Built-in Utilities and Commonly Installed Tools
Minimal installations contain the kernel and essential management tools, but some diagnostic programs are separate packages. Prefer the modern iproute family over ifconfig, route, arp, and netstat; install net-tools only when a legacy workflow or script requires those commands.
Core Utilities Normally Available
|
Utility |
Primary purpose |
Example |
|
ip |
Links, addresses, neighbours, routes, rules, tunnels, VRFs, and namespaces |
ip -br address |
|
ss |
Listening and established TCP, UDP, and UNIX sockets |
ss -lntup |
|
systemctl |
Start, stop, enable, and inspect networking services |
systemctl status NetworkManager |
|
journalctl |
Kernel and service logs |
journalctl -u NetworkManager -b |
|
nmcli |
NetworkManager devices, profiles, DNS, routes, bonds, VLANs, and Wi-Fi |
nmcli device status |
|
hostnamectl |
Display and set the static host name |
hostnamectl status |
|
sysctl |
Inspect and persist kernel network settings |
sysctl net.ipv4.ip_forward |
|
rpm / dnf |
Identify and install packages |
dnf provides ‘*/traceroute’ |
|
curl |
Application-layer HTTP, TLS, proxy, and timing tests |
curl -v https://example.com/ |
Practical Administration Package Set
Install a broad troubleshooting set from enabled base and application repositories:
|
# dnf install -y iproute iputils ethtool NetworkManager NetworkManager-tui \ |
Optional declarative, performance, and advanced tracing tools:
|
# dnf install -y nmstate pcp pcp-system-tools conntrack-tools |
Important package-to-command relationships:
|
Package |
Important commands |
Use |
|
iproute |
ip, ss, bridge, tc, nstat |
Core modern networking administration |
|
iputils |
ping, arping, tracepath |
ICMP reachability, neighbour and path-MTU testing |
|
ethtool |
ethtool |
Link negotiation, driver, offload, ring, channel, and statistics data |
|
NetworkManager |
nmcli, nm-online |
Persistent profiles and device management |
|
NetworkManager-tui |
nmtui |
Text user interface for NetworkManager |
|
nmstate |
nmstatectl |
Declarative state display and application |
|
bind-utils |
dig, host, nslookup, nsupdate |
DNS queries and response analysis |
|
traceroute |
traceroute |
Hop-by-hop path discovery using UDP, ICMP, or TCP probes |
|
nmap-ncat |
nc / ncat |
TCP and UDP listener and connection testing |
|
tcpdump |
tcpdump |
Packet capture and filtering |
|
firewalld |
firewall-cmd, firewall-offline-cmd |
Zone, service, port, rich-rule, NAT, and policy management |
|
nftables |
nft |
Native netfilter ruleset management |
|
sysstat |
sar, sadc, mpstat |
Historical and periodic network and CPU metrics |
|
iperf3 |
iperf3 |
Active TCP and UDP throughput testing |
|
pcp |
pmstat, pminfo, pmrep, pmlogger |
Performance Co-Pilot live and archived metrics |
|
net-tools |
ifconfig, route, arp, netstat |
Legacy compatibility only |
Check whether a command is installed and which package provides it:
|
$ command -v nmcli ip ss ethtool dig traceroute nc tcpdump |
Modern Replacements for Legacy Commands
|
Legacy command |
Preferred command |
Example |
|
ifconfig -a |
ip address show or ip -br address |
ip -br address |
|
ifconfig enp1s0 up |
ip link set dev enp1s0 up |
ip link set dev enp1s0 up |
|
route -n |
ip route show |
ip -4 route show |
|
route add default gw 192.0.2.1 |
ip route add default via 192.0.2.1 |
ip route add default via 192.0.2.1 dev enp1s0 |
|
arp -n |
ip neighbour show |
ip neigh show |
|
netstat -lntup |
ss -lntup |
ss -lntup |
|
netstat -s |
nstat and ss -s |
nstat -az; ss -s |
Legacy commands are still useful when reading old procedures, but they often omit modern attributes such as multiple routing tables, interface alternatives, namespaces, advanced queueing, and protocol-specific socket state.
Networking Layers and Layer-Specific Commands
The practical Linux networking stack can be viewed as a sequence of dependent layers. A name-resolution failure should not be investigated before confirming that the interface, address, neighbour entry, and route are valid. Likewise, an application timeout cannot be assigned to a firewall until packet flow and listening sockets are checked.
|
Layer |
Questions to answer |
Main interrogation tools |
Main configuration tools |
|
Physical |
Is the adapter detected? Is the driver loaded? Is the cable, optic, radio, carrier, speed, and duplex correct? |
lspci, lsusb, lshw, ethtool, iw, rfkill, journalctl -k |
ethtool, driver/module options, firmware, NetworkManager link settings |
|
Data link |
Is the interface up? What are the MAC, MTU, VLAN, bridge, bond, and neighbour states? |
ip -d -s link, bridge, ip neigh, ethtool, iw |
ip link, nmcli, nmstatectl, bridge, bond and VLAN profiles |
|
IP and routing |
Does the host have the correct prefix, gateway, source address, route, and policy rule? |
ip address, ip route, ip rule, ping, tracepath, arping |
ip address/route/rule, nmcli, nmstatectl, keyfiles |
|
Transport |
Is TCP or UDP bound and reachable? Are there resets, retransmissions, or queue pressure? |
ss, nstat, tcpdump, nc, iperf3 |
Service configuration, firewalld/nftables, sysctl, tc |
|
Application and naming |
Does DNS, HTTP, SSH, LDAP, NTP, or NFS complete its protocol exchange? |
dig, getent, curl, openssl, ldapsearch, chronyc, rpcinfo |
Service client files, NetworkManager DNS, SSSD, chrony, fstab |
Physical Layer
The physical layer includes the network adapter, bus, driver, firmware, cable or fibre, transceiver, radio, signal, negotiated speed, and carrier. Linux creates an interface only after a driver successfully binds to detected hardware.
List PCI and USB network hardware and the driver in use:
|
$ lspci -nnk | grep -A3 -Ei ‘ethernet|network’ |
Inspect driver, firmware, permanent bus path, and kernel version:
|
$ ethtool -i enp1s0 |
On Oracle Linux, identify the running kernel before comparing driver behaviour:
|
$ uname -r |
Check carrier, negotiation, and relevant kernel messages:
|
$ ethtool enp1s0 |
Interpretation: carrier value 1 normally means a physical signal is detected; 0 means no usable carrier. Administrative state and physical carrier are separate: an interface can be administratively down while a cable remains connected.
Data-Link Layer
The data-link layer covers Ethernet or Wi-Fi frames, MAC addresses, MTU, VLAN tags, bridges, bonds, and ARP or IPv6 neighbour discovery. UP means administratively enabled. LOWER_UP means the lower layer reports carrier. NO-CARRIER means the device is enabled but the link is unavailable.
|
$ ip -br link |
Temporarily enable an interface and set its MTU:
|
# ip link set dev enp1s0 up |
Warning: Bringing down the interface carrying the administrative session disconnects it. An MTU change can also stall existing connections when the path does not support the new size.
IP, ICMP, and Routing Layer
The IP layer assigns IPv4 and IPv6 addresses, maintains routing tables and policy rules, selects a source address, resolves local neighbours, and reports network conditions through ICMP or ICMPv6.
|
$ ip -br address |
Test the local gateway and a routed destination using an explicit source interface:
|
$ ping -c 4 192.0.2.1 |
TCP and UDP Transport Layer
TCP is connection-oriented and includes a handshake, sequencing, acknowledgements, retransmission, congestion control, and orderly close. UDP sends independent datagrams and has no transport-layer handshake, so an apparently successful UDP probe does not always prove that the application replied.
|
$ ss -lntup |
Test a TCP port and send a UDP probe:
|
$ nc -vz -w 3 192.0.2.20 443 |
A Layered Test Sequence
- Confirm hardware detection, driver binding, and firmware.
- Confirm administrative state, carrier, speed, duplex, MTU, VLAN, bridge, and bond membership.
- Confirm expected IPv4 or IPv6 addresses and prefix lengths.
- Confirm ARP or IPv6 neighbour discovery to the local gateway.
- Confirm the selected route and any policy-routing rule.
- Test by numeric address before testing DNS.
- Confirm a local or remote socket is listening on the expected protocol and port.
- Confirm firewalld zone assignment, nftables policy, and SELinux service permissions.
- Capture packets and correlate timestamps with NetworkManager, kernel, and application logs.
|
$ ip -br link |
Management of Network and Networking Services
Current RHEL and Oracle Linux systems use NetworkManager as the normal owner of persistent interface configuration. A device can still be changed with ip or ethtool, but those changes are runtime-only unless written into a NetworkManager profile or another persistent mechanism.
Identify the Active Network Owner
|
$ systemctl is-active NetworkManager |
Check whether NetworkManager deliberately ignores a device:
|
$ nmcli -f GENERAL.DEVICE,GENERAL.STATE,GENERAL.REASON device show enp1s0 |
A device shown as unmanaged may be excluded by a configuration rule, an installation or cloud tool, or a plugin. Do not create a second manager for the same interface until the reason is understood.
systemd Service Management
|
$ systemctl status NetworkManager |
Warning: Restarting NetworkManager can interrupt every profile it controls. Prefer nmcli connection reload, nmcli device reapply, or activation of one profile.
Understand online targets:
|
$ systemctl status network.target network-online.target |
network.target means the networking service has started, not that a usable route or DNS service exists. Services that truly require configured connectivity should order themselves after network-online.target, with a suitable wait-online implementation enabled.
NetworkManager Device and Profile Management
A NetworkManager connection profile is a saved configuration. A device is the current kernel interface. Multiple profiles can exist for one device, but normally only one profile is active on it.
|
$ nmcli general status |
Activate, deactivate, reload, reapply, or delete a profile:
|
# nmcli connection up LAN |
Change only one setting and verify before activation:
|
# nmcli connection modify LAN connection.autoconnect yes |
Temporarily disconnect or reconnect a device:
|
# nmcli device disconnect enp1s0 |
This differs from nmcli connection down: the device command acts on the device, while the connection command acts on a profile. Both are dangerous over the active management path.
nmtui and Cockpit
Use the text interface on a console or terminal:
|
# nmtui |
The Cockpit web console can manage interfaces, bonds, bridges, VLANs, routes, and firewalld when the required Cockpit packages are installed:
|
# dnf install -y cockpit cockpit-networkmanager |
Expose Cockpit only to trusted management networks and permit TCP 9090 through firewalld only where required.
Nmstate Declarative Management
Nmstate represents desired network state in YAML. It is useful for repeatable configuration, automation, and transactional application.
|
$ nmstatectl show |
Example state file for a static interface:
|
— |
Apply and verify it:
|
# nmstatectl apply /root/enp1s0.yml |
Nmstate checks the resulting state and attempts rollback if application fails, but console access is still required for high-risk remote changes.
NetworkManager Dispatcher Scripts
Dispatcher scripts run on device or connectivity events and are useful for route adjustments, monitoring hooks, or compatibility with old DHCP scripts.
|
# install -m 700 /dev/null /etc/NetworkManager/dispatcher.d/90-example |
Keep scripts fast, non-interactive, idempotent, and secure. A hanging dispatcher script can delay profile activation.
Management of Networking Configuration Files
Persistent state can originate from several locations. Use nmcli, Nmstate, Cockpit, or automation wherever possible rather than editing generated files by hand.
|
Path |
Owner or purpose |
Important notes |
|
/etc/NetworkManager/system-connections/*.nmconnection |
User-created persistent NetworkManager keyfiles |
Root-owned, mode 600; reload after external edits |
|
/run/NetworkManager/system-connections/ |
Runtime-only profiles |
Removed at reboot |
|
/usr/lib/NetworkManager/system-connections/ |
Vendor or predeployed profiles |
Local API changes are copied to /etc or /run |
|
/etc/NetworkManager/NetworkManager.conf |
Main NetworkManager configuration |
Prefer local drop-ins for isolated changes |
|
/etc/NetworkManager/conf.d/*.conf |
Local NetworkManager drop-ins |
Read in lexical order |
|
/etc/NetworkManager/dispatcher.d/ |
Event scripts |
Must be executable, secure, and SELinux-labelled |
|
/etc/sysconfig/network-scripts/ifcfg-* |
Legacy ifcfg profiles |
Older or transitional releases only; unsupported on RHEL 10 and Oracle Linux 10 |
|
/etc/sysconfig/network-scripts/route-* and rule-* |
Legacy routes and rules |
Older releases only |
|
/etc/resolv.conf |
Resolver configuration normally generated by NetworkManager |
Inspect ownership before editing |
|
/etc/hosts and /etc/nsswitch.conf |
Static names and name-service lookup order |
Syntax errors affect all local lookups |
|
/etc/chrony.conf |
Chrony NTP client/server configuration |
Restart or reload chronyd after changes |
|
/etc/sssd/sssd.conf and /etc/sssd/conf.d/*.conf |
SSSD identity and authentication |
Sensitive; mode 600 and correct SELinux context |
|
/etc/openldap/ldap.conf |
OpenLDAP client defaults |
URI, base DN, and CA trust |
|
/etc/fstab |
Persistent mounts including NFS |
Test with mount -a before reboot |
|
/etc/firewalld/ |
Persistent firewalld configuration |
Normally manage with firewall-cmd |
|
/etc/nftables/ or distribution nftables include file |
Native nftables rules |
Use only when firewalld is not the selected manager |
|
/etc/sysctl.conf and /etc/sysctl.d/*.conf |
Persistent kernel network parameters |
Validate with sysctl –system |
Keyfile Profiles
RHEL 10 and Oracle Linux 10 use keyfile profiles exclusively. RHEL 9 and Oracle Linux 9 also use keyfiles as the normal format. A simplified keyfile looks like this:
|
[connection] [ethernet] [ipv4] [ipv6] |
Do not invent UUIDs or manually edit profiles as the normal workflow. Generate or change them with NetworkManager:
|
# nmcli connection add type ethernet con-name LAN ifname enp1s0 \ |
Create a keyfile offline for image building or a chroot:
|
# nmcli –offline connection add type ethernet con-name LAN \ |
Legacy ifcfg Profiles
Use these only on releases that still support them, primarily RHEL/Oracle Linux 8 and some transitional 9 deployments. Do not use them on RHEL 10 or Oracle Linux 10.
|
# /etc/sysconfig/network-scripts/ifcfg-enp1s0 |
After an external file edit:
|
# nmcli connection reload |
Do not run the removed legacy network service on a modern system. NetworkManager can read supported legacy profiles without network.service.
Safe Editing and Validation
|
# install -d -m 700 /root/network-backups |
Validate related files before rebooting:
|
# sysctl –system |
Errors, Logs, and Event Monitoring
Network failures are easier to diagnose when runtime state, logs, and packets are examined with the same timestamps. Begin with the current boot, then widen the time range only when needed.
General and Kernel Logs
|
# journalctl -b -p warning |
Driver resets, transmit timeouts, firmware load failures, PCI errors, renamed interfaces, and carrier transitions normally appear in the kernel journal.
NetworkManager Logs
|
# journalctl -u NetworkManager -b |
Temporarily increase logging while reproducing a problem:
|
# nmcli general logging level DEBUG domains ALL |
Use TRACE only for a short controlled window because it can be very verbose and may expose network metadata.
Related service logs:
|
# journalctl -u firewalld -b |
Live Link, Address, Route, and Profile Events
|
$ ip monitor all |
Run these commands in one terminal while changing cables, activating profiles, renewing DHCP, or reproducing failover in another.
Common Messages and Their Likely Layer
|
Message or symptom |
Likely layer |
First checks |
|
NO-CARRIER or carrier 0 |
Physical/data link |
Cable, optic, radio, switch port, ethtool, rfkill, driver logs |
|
device is strictly unmanaged |
Management |
NetworkManager unmanaged rules and device reason |
|
RTNETLINK answers: File exists |
IP/routing |
Existing address, route, rule, or duplicate configuration |
|
Network is unreachable |
Routing |
Address/prefix, connected route, default route, policy rules |
|
Nexthop has invalid gateway |
Routing |
Gateway must normally be reachable on-link or use explicit onlink semantics |
|
Destination Host Unreachable |
Neighbour/routing |
ARP/NDP, VLAN, prefix, peer state, local route |
|
Connection refused |
Transport/application |
Listener absent, wrong bind address, TCP reset, reject rule |
|
Connection timed out |
Path/filtering |
Route, silent firewall drop, server down, return path |
|
Temporary failure in name resolution |
DNS/NSS |
/etc/resolv.conf, nmcli DNS, DNS reachability, nsswitch |
|
activation failed: IP configuration could not be reserved |
DHCP/IP |
DHCP server, pool, duplicate address, VLAN, timeout |
|
duplicate address detected |
IP |
arping, duplicate-address detection, stale profile, cloned VM |
|
martian source / rp_filter drop |
Routing/security |
Asymmetric path, policy routing, reverse-path filtering |
Collect a concise failure snapshot before restarting anything:
|
# date -Ins |
Interface Discovery and Link Management
Discover All Interfaces
Display concise link and address summaries:
|
$ ip -br link |
Show all details for one interface:
|
$ ip -details -statistics link show dev enp1s0 |
Useful state terms:
|
State or flag |
Meaning |
|
UP |
The interface is administratively enabled. |
|
DOWN |
The interface is administratively disabled. |
|
LOWER_UP |
The lower layer reports a working carrier. |
|
NO-CARRIER |
The device is up but no usable physical or virtual carrier exists. |
|
UNKNOWN |
The driver or virtual device does not expose a normal carrier state. |
|
unmanaged |
NetworkManager is not controlling the device. |
|
disconnected |
NetworkManager controls the device but no profile is active. |
|
connected |
A NetworkManager profile is active. |
Show only interfaces that are operationally up:
|
$ ip -br link | awk ‘$2 ~ /UP/ {print}’ |
Predictable names such as enp1s0, eno1, and ens3 describe firmware, onboard, slot, or bus topology. Legacy names such as eth0 can still appear when predictable naming is disabled, overridden, or inherited from an older installation.
Distinguish Physical, Virtual, and Hardware-Backed Interfaces
A hardware-backed interface normally has a sysfs device path:
|
$ test -e /sys/class/net/enp1s0/device && echo hardware-backed |
List likely interface type and driver information:
|
$ for path in /sys/class/net/*; do |
Common virtual types include lo, bond, bridge, vlan, dummy, veth, tun, tap, macvlan, ipvlan, vrf, and container-created interfaces. Use the detailed link output to expose the kind and parent relationship:
|
$ ip -d link show |
Discover Wireless Interfaces
Install iw if the minimal image does not contain it:
|
# dnf install -y iw wireless-regdb |
List radios, wireless interfaces, and association state:
|
$ iw phy |
Check radio blocks and NetworkManager Wi-Fi state:
|
$ rfkill list |
Connect interactively so the password is not placed in shell history:
|
# nmcli –ask device wifi connect “ExampleSSID” ifname wlp2s0 |
Create a WPA-PSK profile non-interactively only in controlled automation:
|
# nmcli connection add type wifi ifname wlp2s0 con-name office-wifi ssid ExampleSSID |
Warning: A secret supplied on the command line can be captured in shell history, audit records, or process inspection. Prefer nmcli –ask, a protected keyfile, or an enterprise secret-management workflow.
Find the MAC Address
Display the current MAC address:
|
$ ip link show dev enp1s0 |
Display the permanent hardware address when the driver supports it:
|
$ ethtool -P enp1s0 |
Temporarily change the MAC address:
|
# ip link set dev enp1s0 down |
Persist a cloned MAC in a NetworkManager profile:
|
# nmcli connection modify LAN 802-3-ethernet.cloned-mac-address 02:00:00:00:01:10 |
Restore the permanent address:
|
# nmcli connection modify LAN 802-3-ethernet.cloned-mac-address permanent |
A MAC change can invalidate switch-port security, DHCP reservations, neighbour caches, virtualisation policy, and licensing. Use a locally administered address; a first octet such as 02 sets the local bit without setting the multicast bit.
Find Advanced Interface Properties
|
$ ip -details -statistics link show dev enp1s0 |
Inspect selected sysfs properties:
|
$ grep . /sys/class/net/enp1s0/{operstate,carrier,mtu,tx_queue_len,address} 2>/dev/null |
Identify the active profile and its persistent properties:
|
$ nmcli -g GENERAL.CONNECTION device show enp1s0 |
Find Link Speed and Duplex
ethtool provides the most direct Ethernet view:
|
$ ethtool enp1s0 | grep -E ‘Supported link modes:|Advertised link modes:|Speed:|Duplex:|Auto-negotiation:|Link detected:’ |
Alternative script-friendly views:
|
$ cat /sys/class/net/enp1s0/speed 2>/dev/null |
The sysfs speed is normally reported in megabits per second. -1, unknown, or an input/output error usually means the link is down or the driver does not expose the property. Virtual interfaces often have no meaningful physical link speed.
Configure Fixed or Automatic Link Speed
Set 100 Mbit/s full duplex with autonegotiation disabled until the next device reset, profile reactivation, or reboot:
|
# ethtool -s enp1s0 autoneg off speed 100 duplex full |
Return to automatic negotiation:
|
# ethtool -s enp1s0 autoneg on |
Persist fixed speed and duplex in a NetworkManager profile:
|
# nmcli connection modify LAN \ |
For a 1 Gbit/s copper link, keep autonegotiation enabled and advertise the intended mode:
|
# nmcli connection modify LAN \ |
Restore unrestricted autonegotiation:
|
# nmcli connection modify LAN \ |
Warning: Both link partners must use compatible settings. A duplex mismatch can produce high CRC errors, late collisions, retransmissions, and very poor throughput. Copper 1000BASE-T normally requires autonegotiation; do not disable it merely to force a nominal 1 Gbit/s speed.
Verify after every change:
|
$ ethtool enp1s0 |
Administrative State, MTU, Offloads, Rings, and Channels
Temporary administrative and MTU changes:
|
# ip link set dev enp1s0 up |
Persist MTU through the profile:
|
# nmcli connection modify LAN 802-3-ethernet.mtu 9000 |
Jumbo frames require the host, VLAN path, switches, routers, hypervisors, and destination to support the larger frame. Probe a 1500-byte IPv4 path with 1472 bytes of ICMP payload:
|
$ ping -c 3 -M do -s 1472 198.51.100.25 |
Temporarily alter selected offloads:
|
$ ethtool -k enp1s0 |
Offload changes are useful for diagnosis but can significantly increase CPU load. Record the original state and restore it after testing:
|
# ethtool -K enp1s0 gro on gso on tso on |
Inspect and tune rings or channels only when supported by the driver:
|
$ ethtool -g enp1s0 |
Persistent ethtool settings can be stored as NetworkManager properties on releases that expose the corresponding ethtool.* keys. List available settings before relying on a particular property:
|
$ nmcli –fields all connection show LAN | grep -i ethtool |
Driver and NetworkManager property support varies by release and adapter. Treat an unknown property error as a capability/version issue rather than silently assuming the setting persisted.
Configure Virtual Interfaces
Linux virtual interfaces are useful for service addresses, virtual machines, containers, routing, tests, and segmentation. Objects created with ip are temporary unless NetworkManager, a systemd unit, container runtime, or orchestration system recreates them.
Dummy Interface
Temporary dummy interface:
|
# ip link add dummy0 type dummy |
Persistent NetworkManager dummy profile:
|
# nmcli connection add type dummy ifname dummy0 con-name dummy0 \ |
Dummy addresses are useful for loopback-style service endpoints, routing daemons, and stable source addresses. Ensure routes and firewall rules intentionally handle the address.
Virtual Ethernet Pair
A veth pair behaves like a virtual patch cable. Frames entering one end exit the peer:
|
# ip link add veth-a type veth peer name veth-b |
Move one end into a namespace:
|
# ip netns add testns |
Bridge Interface
A bridge forwards Ethernet frames among member ports and is frequently used by KVM/libvirt and container hosts.
Temporary bridge:
|
# ip link add br0 type bridge |
Place the host address on br0, not on the enslaved physical port:
|
# ip address flush dev enp2s0 |
Persistent NetworkManager bridge:
|
# nmcli connection add type bridge ifname br0 con-name br0 \ |
Older nmcli versions accept the equivalent port syntax master br0 slave-type bridge.
Verify bridge state:
|
$ nmcli connection show –active |
Macvlan and Ipvlan Interfaces
A macvlan interface has its own MAC address on a parent. In bridge mode, macvlan peers can communicate through the parent, but direct host-to-macvlan communication requires additional design.
|
# ip link add macvlan0 link enp1s0 type macvlan mode bridge |
Persistent NetworkManager macvlan profile:
|
# nmcli connection add type macvlan con-name macvlan0 ifname macvlan0 \ |
Ipvlan shares the parent MAC and separates traffic by IP. A temporary L2-mode example:
|
# ip link add link enp1s0 name ipvlan0 type ipvlan mode l2 |
Static and DHCP IP Addressing
An address contains an IP and prefix, such as 192.0.2.10/24 or 2001:db8:1::10/64. The prefix defines the directly connected network. Temporary ip commands change only the running kernel state. Persistent settings belong in the NetworkManager connection profile.
Inspect Current Addresses and Address Metadata
|
$ ip -br address |
Important flags include dynamic, secondary, temporary, tentative, deprecated, noprefixroute, valid_lft, and preferred_lft. A tentative IPv6 address is still undergoing duplicate-address detection.
Temporary Static IPv4 Address – Add, Change, and Delete
Add an address without removing existing addresses:
|
# ip address add 192.0.2.10/24 dev enp1s0 |
Replace or delete an exact entry:
|
# ip address replace 192.0.2.10/24 dev enp1s0 |
Flush all global IPv4 addresses only when this destructive action is intended:
|
# ip -4 address flush dev enp1s0 scope global |
Warning: Flushing can remove both static and DHCP-derived addresses and disconnect every session using the device. Prefer deleting one exact prefix.
Temporary Static IPv6 Address
|
# ip -6 address add 2001:db8:1::10/64 dev enp1s0 |
An IPv6 default gateway is commonly a link-local address and therefore requires an interface:
|
# ip -6 route add default via fe80::1 dev enp1s0 metric 100 |
Persistent Static Address with NetworkManager
Create a new static dual-stack profile:
|
# nmcli connection add type ethernet ifname enp1s0 con-name LAN \ |
Modify the primary address:
|
# nmcli connection modify LAN ipv4.addresses 192.0.2.20/24 |
Add and remove a secondary address without replacing the primary:
|
# nmcli connection modify LAN +ipv4.addresses 192.0.2.21/24 |
Disable a protocol family when it is deliberately unused:
|
# nmcli connection modify LAN ipv6.method disabled |
Using ipv6.method disabled is a policy choice. Do not disable IPv6 merely to hide a DNS or routing problem; local applications and infrastructure may depend on it.
Inspect the saved profile and active state:
|
$ nmcli connection show LAN |
Persistent Static Address with Nmstate
Create /root/lan-static.yml:
|
interfaces: |
Preview, apply, and verify:
|
# nmstatectl show |
When supported, the no-commit transaction automatically rolls back unless committed. Confirm the local nmstatectl –help options because transaction behaviour differs across package versions.
Legacy ifcfg Static Address – RHEL/Oracle Linux 8 Only
Version note: RHEL 9 and Oracle Linux 9 default to keyfiles. RHEL 10 and Oracle Linux 10 do not support ifcfg profiles. Use this only for an older system that already relies on /etc/sysconfig/network-scripts/ifcfg-*.
Example /etc/sysconfig/network-scripts/ifcfg-enp1s0:
|
TYPE=Ethernet |
Reload and activate through NetworkManager rather than invoking removed network scripts:
|
# nmcli connection reload |
Migrate an existing ifcfg profile to a keyfile before a major-version upgrade where possible:
|
$ nmcli connection show |
The availability and behaviour of nmcli connection migrate depend on NetworkManager version. Back up both profile directories and inspect the result before deleting the old file.
Configure DHCP with NetworkManager
Create a DHCP profile:
|
# nmcli connection add type ethernet ifname enp1s0 con-name LAN-DHCP \ |
Convert an existing static profile to DHCP and clear manual IPv4 fields:
|
# nmcli connection modify LAN \ |
Use DHCP for address and routes but ignore DHCP-provided DNS:
|
# nmcli connection modify LAN \ |
Ignore DHCP-provided default routes while retaining the address:
|
# nmcli connection modify LAN ipv4.never-default yes |
Set route priority for a DHCP profile:
|
# nmcli connection modify LAN ipv4.route-metric 100 ipv6.route-metric 100 |
Renewing through NetworkManager generally requires profile reactivation:
|
# nmcli connection down LAN && nmcli connection up LAN |
This interrupts traffic. On a remote system, use console access or arrange rollback. RHEL 10 removed the standalone dhclient utility; NetworkManager’s internal DHCP client is the supported path. Older releases may still contain dhclient, but mixing it with a NetworkManager-managed interface can create conflicting leases and addresses.
DHCP with Nmstate
|
interfaces: |
Apply and inspect:
|
# nmstatectl apply /root/lan-dhcp.yml |
Legacy ifcfg DHCP – RHEL/Oracle Linux 8 Only
|
TYPE=Ethernet |
Apply through NetworkManager:
|
# nmcli connection reload |
Verify a DHCP Lease
|
$ ip -br address show dev enp1s0 |
A valid lease can supply an address and prefix, lease lifetime, default and classless routes, DNS servers, search domains, NTP servers, and MTU. Missing DNS does not prove that the address lease failed; inspect each field independently.
Duplicate-Address Checks
Probe an intended IPv4 address before assigning it:
|
# arping -D -I enp1s0 -c 3 192.0.2.10 |
After assignment, announce it to update nearby ARP caches:
|
# arping -A -I enp1s0 -c 3 192.0.2.10 |
Watch duplicate-address detection and neighbour messages:
|
# journalctl -k -b | grep -Ei ‘duplicate|dad|address conflict’ |
No ARP reply does not prove an address is free when VLANs, filtering, sleeping systems, proxy ARP, or network isolation are involved. Confirm with IP address management or DHCP reservation records.
VLANs and IEEE 802.1Q Tagging
A VLAN creates a separate Layer 2 broadcast domain by adding an IEEE 802.1Q tag containing a VLAN ID. A switch access port normally carries one untagged VLAN. A trunk carries one or more tagged VLANs. The host parent and switch port must agree on tagging, native VLAN, allowed IDs, MTU, and link aggregation membership.
Temporary VLAN Interface
Create VLAN 100 on enp1s0:
|
# ip link add link enp1s0 name vlan100 type vlan id 100 |
Delete it:
|
# ip link delete vlan100 |
Persistent VLAN with NetworkManager
|
# nmcli connection add type vlan con-name vlan100 ifname vlan100 \ |
For a VLAN without a default route:
|
# nmcli connection modify vlan100 ipv4.never-default yes |
Create a VLAN on a bond by using bond0 as the parent:
|
# nmcli connection add type vlan con-name bond0.100 ifname bond0.100 \ |
Persistent VLAN with Nmstate
|
interfaces: |
Legacy ifcfg VLAN – RHEL/Oracle Linux 8 Only
Example /etc/sysconfig/network-scripts/ifcfg-enp1s0.100:
|
TYPE=Vlan |
VLAN Verification and Troubleshooting
|
$ ip -d link show type vlan |
- No tagged frames leaving the parent usually means the VLAN profile is inactive, traffic is not routed through it, or a bridge/bond relationship is wrong.
- Tagged frames leaving with no return traffic point to the switch trunk, allowed VLAN list, native VLAN, remote access port, or remote host.
- Untagged service traffic belongs on the parent or a bridge access port, not an 802.1Q subinterface.
- A VLAN over a bond must be attached to the bond, not independently to each bond member.
- Hardware VLAN offload can make a capture on the VLAN interface look different from a capture on the parent. Capture both when diagnosing tag placement.
Failover IP Address over Two Interfaces
For one host with two links to the same Layer 2 network, use an active-backup bond. Assign the IP to bond0, not separately to both member interfaces. The active member carries traffic and a standby takes over when link monitoring reports failure.
A floating service IP between two separate hosts is different. That normally uses VRRP/keepalived, Pacemaker, a cloud floating-IP mechanism, or a load balancer. Both patterns are shown, but they solve different failure domains.
Active-Backup Bond with NetworkManager
Create the bond and ports with current controller/port terminology:
|
# nmcli connection add type bond con-name bond0 ifname bond0 \ |
Older NetworkManager versions use equivalent master bond0 slave-type bond syntax for the port profiles.
Inspect the relationship:
|
$ nmcli device status |
Active-Backup Bond with Nmstate
|
interfaces: |
Legacy ifcfg Active-Backup Bond – RHEL/Oracle Linux 8 Only
ifcfg-bond0:
|
TYPE=Bond |
ifcfg-enp1s0:
|
TYPE=Ethernet |
Create the corresponding ifcfg-enp2s0, reload, and activate:
|
# nmcli connection reload |
Test Active-Backup Failover
- Start a continuous ping through bond0.
- Confirm the currently active member in /proc/net/bonding/bond0.
- Disable the active switch port or administratively lower the member.
- Confirm the standby becomes active and observe packet loss.
- Restore the member and verify the configured primary re-selection policy.
|
$ watch -n 1 cat /proc/net/bonding/bond0 |
If failover changes the active member but traffic does not resume, inspect gratuitous ARP, switch port security, VLAN parity, MAC movement limits, neighbour caches, and upstream asymmetric filtering.
Floating IP Between Two Hosts with keepalived
Example requirement: node1 and node2 share service address 192.0.2.100/24 on enp1s0. Install keepalived on both:
|
# dnf install -y keepalived |
Example /etc/keepalived/keepalived.conf on the preferred node:
|
global_defs { vrrp_instance VI_1 { |
On the second node, use a lower priority such as 100 and a unique router_id. Start and verify:
|
# systemctl enable –now keepalived |
For unicast VRRP on networks that do not pass multicast, configure explicit unicast_src_ip and unicast_peer addresses on both nodes. Protect the configuration, use a stronger operational security design than the simple example password, and test split-brain behaviour.
LACP / IEEE 802.3ad Aggregation
An 802.3ad bond negotiates an aggregation group with the switch using LACP. It provides redundancy and can spread multiple flows across links. A single flow is normally hashed to one member and therefore usually cannot exceed one member’s line rate.
The switch ports must be in the same compatible LACP port-channel. Independent switches require a vendor-supported multi-chassis aggregation technology. The VLAN list, native VLAN, MTU, speed, and duplex must match on every member.
Version note: Network teaming is deprecated in RHEL 9 and Oracle Linux 9. The team driver and teamd are removed in RHEL 10. Use kernel bonding for new designs and migrate teams before upgrading.
LACP Bond with NetworkManager
|
# nmcli connection add type bond con-name bond0 ifname bond0 \ |
LACP Bond with Nmstate
|
interfaces: |
Legacy ifcfg LACP Bond – RHEL/Oracle Linux 8 Only
|
TYPE=Bond |
Member profiles use MASTER=bond0 and SLAVE=yes, as shown for active-backup.
Verify LACP State and Traffic Distribution
|
$ cat /proc/net/bonding/bond0 |
Healthy members in one aggregator normally show compatible actor and partner keys, the same partner system MAC, and collecting/distributing state. Exercise multiple flows rather than one flow:
|
$ iperf3 -c 198.51.100.20 -P 8 |
Common LACP failures:
|
Symptom |
Likely cause |
|
One member never aggregates |
Switch port not in the channel, mismatched key, speed/duplex, or LACP mode. |
|
Both members up but traffic one-way |
VLAN or native VLAN mismatch, switch hashing or port-channel inconsistency. |
|
Only one member carries a single test |
Expected per-flow hashing; use several source/destination/port combinations. |
|
Bond goes down when one member fails |
min_links too high, switch removes the aggregator, or monitoring is wrong. |
|
Frequent member churn |
Physical errors, optics, LACP timer mismatch, driver resets, or switch instability. |
Routing
Linux normally chooses the longest prefix match, then considers preference and metric among otherwise equivalent routes. Connected routes are created from interface prefixes. Policy rules can select additional routing tables based on source, destination, incoming interface, firewall mark, or other attributes.
List All Routes and Rules
|
$ ip -4 route show |
Filter by interface, protocol, or default:
|
$ ip route show dev enp1s0 |
Temporary Default Route – Add, Change, and Delete
|
# ip route add default via 192.0.2.1 dev enp1s0 metric 100 |
IPv6 through a link-local next hop:
|
# ip -6 route add default via fe80::1 dev enp1s0 metric 100 |
Temporary Static Route – Add, Change, and Delete
|
# ip route add 198.51.100.0/24 via 192.0.2.254 dev enp1s0 metric 50 |
Special routes:
|
# ip route add blackhole 203.0.113.0/24 |
ip route replace is useful in idempotent scripts because it creates an absent route and replaces an existing matching destination. Always check ip route get after a change to confirm the selected source, table, device, and next hop.
Permanent Default Route with NetworkManager
Set or replace the gateway on a static profile:
|
# nmcli connection modify LAN ipv4.gateway 192.0.2.1 |
Prevent a profile from installing any default route:
|
# nmcli connection modify BACKUP-LAN ipv4.never-default yes ipv6.never-default yes |
For DHCP profiles, lower metrics are preferred:
|
# nmcli connection modify WIRED ipv4.route-metric 100 |
Permanent Static Routes with NetworkManager
Add a route to an existing profile:
|
# nmcli connection modify LAN \ |
Add several routes in one property:
|
# nmcli connection modify LAN ipv4.routes \ |
Remove one exact route:
|
# nmcli connection modify LAN \ |
Inspect persistent and active routes:
|
$ nmcli -f ipv4.gateway,ipv4.routes,ipv4.route-metric connection show LAN |
Permanent Routes with Nmstate
|
routes: |
Legacy Static Route Files – RHEL/Oracle Linux 8 Only
A route file corresponding to ifcfg-enp1s0 can use command-style entries in /etc/sysconfig/network-scripts/route-enp1s0:
|
198.51.100.0/24 via 192.0.2.254 dev enp1s0 metric 50 |
IPv6 routes can be placed in route6-enp1s0. Reload and reactivate through NetworkManager:
|
# nmcli connection reload |
Do not introduce new legacy route files on RHEL/Oracle Linux 9 or 10. Store routes in keyfile profiles through nmcli, Nmstate, the RHEL system role, or equivalent automation.
Multiple Default Routes and Metrics
Temporary wired-primary and wireless-backup example:
|
# ip route replace default via 192.0.2.1 dev enp1s0 metric 100 |
Persistent profile metrics:
|
# nmcli connection modify WIRED ipv4.route-metric 100 ipv6.route-metric 100 |
Two defaults do not automatically guarantee application-level failover. Existing TCP sessions normally break when source address or path changes. DNS, VPN policy, firewall state, reverse-path filtering, and cloud routing can also affect failover.
Policy Routing
Temporary source-based routing through table 100:
|
# ip route add table 100 192.0.2.0/24 dev enp1s0 src 192.0.2.10 |
Remove in reverse order:
|
# ip rule del priority 100 |
Persistent NetworkManager route and rule example:
|
# nmcli connection modify LAN \ |
Inspect:
|
$ nmcli -f ipv4.routes,ipv4.routing-rules connection show LAN |
Warning: Policy routing can create asymmetric forward and return paths. Stateful firewalls, strict reverse-path filtering, load balancers, and upstream routers may drop otherwise valid traffic. Test both directions and every source address.
Enable IP Forwarding
Temporary router settings:
|
# sysctl -w net.ipv4.ip_forward=1 |
Persist in /etc/sysctl.d/60-router.conf:
|
net.ipv4.ip_forward = 1 |
Forwarding does not create a firewall forward policy or NAT. Configure those separately and keep ICMP/ICMPv6 types required for error reporting, neighbour discovery, and path-MTU discovery.
Host Naming and Naming Services
Linux name resolution is broader than DNS. Most applications use the GNU C Library Name Service Switch (NSS), which can consult local files, DNS, systemd modules, mDNS, SSSD, LDAP, and other sources according to /etc/nsswitch.conf. Use getent to test the same lookup path that normal applications use.
Display and Configure the Host Name
|
$ hostnamectl status |
Set a persistent fully qualified host name:
|
# hostnamectl set-hostname web01.example.com |
Add a deliberate local mapping in /etc/hosts when required:
|
127.0.0.1 localhost localhost.localdomain |
Test through NSS:
|
$ getent hosts web01 |
hostname –fqdn depends on name service data and is not simply the text stored in /etc/hostname. Confirm both the name and the address returned by getent.
Inspect Name Service Switch Order
|
$ grep -E ‘^(hosts|networks|passwd|group|netgroup|automount):’ /etc/nsswitch.conf |
A simple host lookup order is:
|
hosts: files dns myhostname |
Actual installations can contain resolve, mdns4_minimal, mymachines, sss, or other modules. Do not replace the line blindly. Desktop discovery, containers, SSSD, and local policy can depend on the existing order.
RHEL and Oracle Linux systems using authselect can manage selected NSS and PAM settings. Inspect before editing identity-related entries:
|
$ authselect current |
DNS Client Configuration and Management
By default, NetworkManager receives DNS information from static profiles, DHCP, VPNs, and other connections and writes resolver configuration. /etc/resolv.conf is often NetworkManager-managed. It can also be a symbolic link when systemd-resolved, dnsmasq, or another local resolver is deliberately enabled.
Inspect Resolver Configuration and Test Name Resolution
|
$ ls -l /etc/resolv.conf |
Test the application/NSS path:
|
$ getent ahosts app.example.com |
Test DNS directly:
|
$ dig app.example.com A |
getent can return local /etc/hosts or SSSD data and reflects NSS ordering. dig bypasses NSS and interrogates DNS, making it better for flags, TTLs, authority data, DNSSEC details, and testing a specific server.
Configure Static DNS Servers with NetworkManager
Use only the configured DNS servers and ignore DHCP-provided servers:
|
# nmcli connection modify LAN \ |
Add or remove one DNS server without replacing the whole list:
|
# nmcli connection modify LAN +ipv4.dns 192.0.2.55 |
Return to DHCP-provided DNS:
|
# nmcli connection modify LAN \ |
DNS Priority and Split-DNS Behaviour
When several active profiles provide DNS servers, NetworkManager uses DNS priorities and connection type to order them. A lower numeric priority is preferred:
|
# nmcli connection modify LAN ipv4.dns-priority 50 ipv6.dns-priority 50 |
A negative DNS priority can exclude DNS from profiles with higher numerical priority. Use negative values only after testing VPN and split-DNS behaviour; they can unexpectedly hide otherwise valid resolvers.
Search domains are appended to short names. Route-only domains are most useful when NetworkManager is integrated with a resolver that supports per-link routing, such as systemd-resolved. A leading tilde marks a route-only domain:
|
# nmcli connection modify CORP-VPN ipv4.dns-search ‘~corp.example.com’ |
On the default direct /etc/resolv.conf path, per-link split DNS is limited because traditional resolver files contain one global ordered server list. Use an approved local resolver or VPN integration when true split DNS is required.
Optional systemd-resolved Integration
First check whether it is installed and active:
|
$ systemctl status systemd-resolved |
A controlled NetworkManager integration normally requires the NetworkManager DNS mode and an appropriate /etc/resolv.conf symlink. Example /etc/NetworkManager/conf.d/20-resolved.conf:
|
[main] |
Apply during a maintenance window:
|
# systemctl enable –now systemd-resolved |
Do not make this change casually on production hosts. VPN software, local caching resolvers, container runtimes, and security policy can expect a different resolver ownership model. Back up the original file and configuration.
When systemd-resolved is active:
|
$ resolvectl query app.example.com |
Manual /etc/resolv.conf Configuration
A minimal static file looks like:
|
search example.com |
However, NetworkManager can overwrite it. Prefer profile properties. If a specific architecture requires NetworkManager not to manage the file, configure that deliberately in /etc/NetworkManager/NetworkManager.conf and document the new owner. Do not use chattr +i /etc/resolv.conf as a routine fix; it hides ownership problems and can break DHCP, VPN, and automation.
DNS Troubleshooting Sequence
|
$ getent ahosts app.example.com |
Interpret common responses:
|
Result |
Meaning |
|
NXDOMAIN |
The queried name does not exist according to the server. |
|
SERVFAIL |
Server-side validation, delegation, forwarding, or upstream failure. |
|
REFUSED |
Server policy refuses the query or recursion. |
|
Timeout over UDP but TCP works |
Fragmentation, EDNS, firewall, or UDP path issue. |
|
dig works but getent fails |
NSS order, resolver ownership, search domain, or application lookup difference. |
|
One server works, another fails |
Profile ordering, server outage, routing, ACL, or split-DNS error. |
NTP Client Configuration and Management
Accurate time is required for TLS validation, Kerberos, LDAP, distributed databases, logs, cluster decisions, monitoring, and incident correlation. Chrony is the standard client and server implementation on supported RHEL and Oracle Linux releases.
Install, Enable, and Inspect Chrony
|
# dnf install -y chrony |
Important indicators:
|
Field |
Interpretation |
|
Leap status Normal |
The clock is synchronized or usable. |
|
Reference ID |
Current selected time source. |
|
Stratum |
Distance from a reference clock; lower is not automatically better. |
|
System time |
Current offset between system and corrected clock. |
|
Last offset / RMS offset |
Recent and long-term error. |
|
* in sources |
Selected source. |
|
+ |
Acceptable combined source. |
|
– |
Acceptable but not currently combined. |
|
? |
Unreachable, unselectable, or insufficient samples. |
|
x |
Source judged false. |
Configure Chrony Servers or Pools
Back up /etc/chrony.conf, then use approved sources:
|
server ntp1.example.com iburst makestep 1.0 3 |
Restart and verify:
|
# chronyd -Q -f /etc/chrony.conf |
chronyd -Q measures and reports the offset without setting the clock. Use chronyd -q carefully because it sets the clock once and exits; it can conflict with the running service.
Force a short burst of measurements and step a large offset when policy allows:
|
# chronyc burst 4/4 |
A time step can disturb databases, authentication, scheduled work, and monotonicity assumptions. Prefer gradual correction on established production systems unless the offset is operationally unacceptable.
Network Time Security and Client Firewalling
When the installed Chrony version and server support Network Time Security:
|
server nts.example.com iburst nts |
NTP normally uses UDP port 123. NTS key exchange normally uses TCP port 4460 in addition to NTP. A client usually needs outbound access and established return traffic rather than an inbound server rule.
Test reachability and packet flow:
|
$ getent ahosts ntp1.example.com |
Chrony and NetworkManager Events
NetworkManager dispatcher integration can mark network sources online and offline as interfaces change. Inspect the dispatcher and service logs:
|
$ ls -l /etc/NetworkManager/dispatcher.d/20-chrony* /usr/lib/NetworkManager/dispatcher.d/20-chrony* 2>/dev/null |
If a source remains offline after configuring links outside NetworkManager, use:
|
# chronyc online |
NTP Troubleshooting
|
$ timedatectl status |
Common causes of ? sources include DNS failure, no route, firewall filtering, server ACLs, a source that is not serving time, a very large initial offset, or an offline state. TLS or NTS failures can also result from an incorrect system clock or missing CA trust.
LDAP Client Configuration and Management
SSSD is the preferred client integration layer for LDAP and many identity environments. It provides NSS and PAM integration, caching, failover, access control, TLS support, and diagnostic tools. For Active Directory or Red Hat Identity Management, use the appropriate AD or IPA provider rather than treating those environments as generic LDAP when possible.
Test Directory Connectivity Before NSS/PAM Integration
Install client tools and test DNS, routing, TCP, TLS, and a base search first:
|
# dnf install -y openldap-clients |
For StartTLS on port 389:
|
$ ldapsearch -x -H ldap://ldap01.example.com -ZZ \ |
Do not continue to PAM integration until the certificate name, CA chain, DNS, and simple LDAP query are correct.
Install SSSD and Select the Authentication Profile
|
# dnf install -y sssd sssd-ldap sssd-tools oddjob oddjob-mkhomedir openldap-clients |
Warning: authselect –force can overwrite unsupported manual PAM/NSS changes. Back up /etc/pam.d, /etc/nsswitch.conf, and the current authselect profile before replacing an established authentication stack.
Trust the LDAP Certificate Authority
Copy the issuing CA certificate into the system trust store:
|
# cp example-root-ca.pem /etc/pki/ca-trust/source/anchors/ |
Re-test the TLS connection using the server’s real DNS name. Do not disable certificate verification as a permanent workaround.
Configure SSSD for LDAP
Example /etc/sssd/sssd.conf using LDAPS and anonymous or server-authorized searches:
|
[sssd] [nss] [pam] [domain/example.com] ldap_uri = ldaps://ldap01.example.com, ldaps://ldap02.example.com ldap_user_search_base = ou=People,dc=example,dc=com cache_credentials = true |
Protect, validate, and start:
|
# chown root:root /etc/sssd/sssd.conf |
For StartTLS, use LDAP URIs and require TLS:
|
ldap_uri = ldap://ldap01.example.com, ldap://ldap02.example.com |
A directory that requires a search bind can use ldap_default_bind_dn and an authentication token. The token is stored in the protected SSSD file, so use the least-privileged read-only account and a secret-management process. Avoid embedding privileged directory credentials.
Verify LDAP Identity and Authentication Paths
|
$ getent passwd alice |
Check home-directory creation and PAM without exposing a production password in logs. A controlled console login is preferable to repeated remote tests.
Clear one cached entry after a directory correction:
|
# sss_cache -u alice |
Clear the entire cache only when necessary:
|
# sss_cache -E |
Clearing all cached identity data increases directory load and removes offline records. Prefer the narrowest operation.
LDAP and SSSD Logs
|
$ journalctl -b -u sssd |
Increase SSSD debug level for a short diagnostic window by adding debug_level = 6 to the affected domain, restarting SSSD, reproducing the issue, and then removing the setting. High levels can log sensitive metadata and create large files.
|
Symptom |
Common cause |
Focused check |
|
ldapsearch works but getent fails |
NSS/SSSD profile, cache, service, or search-base issue |
authselect check, sssctl config-check, SSSD logs. |
|
Certificate verification fails |
Missing CA, wrong DNS name, expired certificate, or wrong clock |
openssl s_client, trust store, timedatectl. |
|
User resolves but login fails |
PAM, access filter, shell, password policy, or account lock |
sssctl user-checks, secure journal, directory policy. |
|
Intermittent long delays |
DNS ordering, unreachable URI, referrals, enumeration, or failover timeout |
Test each server directly; keep enumerate=false. |
|
Offline login fails |
Credentials not previously cached or cache expired |
Complete one online login and review offline policy. |
|
Duplicate or inconsistent IDs |
Multiple identity sources or conflicting uidNumber/gidNumber |
getent, SSSD domains, local files, directory data. |
NFS Client Configuration and Management
NFS mounts server-exported file systems into the local directory tree. NFSv4 normally uses TCP port 2049 and has a cleaner firewall model than older versions. Export permissions, security flavour, identity mapping, and file ownership are controlled by the server and directory environment as well as the network path.
Install NFS Client Utilities and Discover Exports
|
# dnf install -y nfs-utils |
showmount uses the older mount protocol and can fail or return nothing against a pure NFSv4 server even when NFSv4 mounts work. Confirm the NFSv4 pseudo-filesystem path with the server administrator.
Mount and Unmount an NFS File System
|
# mkdir -p /mnt/projects |
Test access and numeric ownership:
|
$ stat -f /mnt/projects |
A successful mount does not prove that UID/GID mapping, SELinux policy, application credentials, or server export permissions are correct.
Persistent NFS Mount in /etc/fstab
An on-demand systemd automount avoids blocking boot when the server or network is unavailable:
|
nfs01.example.com:/projects /mnt/projects nfs4 rw,_netdev,nofail,x-systemd.automount,x-systemd.idle-timeout=600,vers=4.2,proto=tcp 0 0 |
Activate and test:
|
# mkdir -p /mnt/projects |
NFS hard mounts are normally preferred for data integrity because operations continue retrying through transient outages. Soft mounts can turn a network interruption into application I/O errors and possible corruption. Use them only with a documented application-specific reason.
Automount Many NFS Paths with autofs
|
# dnf install -y autofs |
Example /etc/auto.master.d/projects.autofs:
|
/projects /etc/auto.projects –timeout=600 |
Example /etc/auto.projects:
|
engineering -fstype=nfs4,rw,vers=4.2 nfs01.example.com:/projects/engineering |
Kerberos-Secured NFS
Security flavours krb5, krb5i, and krb5p provide authentication, integrity, and privacy respectively. They require correct forward and reverse DNS, synchronized time, Kerberos configuration, host credentials, and the NFS GSS services.
|
# systemctl enable –now rpc-gssd |
Troubleshoot the identity and time path before blaming NFS transport:
|
$ klist |
SELinux and NFS Client Access
SELinux can allow an interactive shell to read an NFS mount while preventing a confined service from using it. Inspect relevant booleans:
|
$ getsebool -a | grep -i nfs |
Enable only the boolean required by the service:
|
# setsebool -P httpd_use_nfs on |
Investigate denials rather than disabling SELinux:
|
# ausearch -m AVC,USER_AVC -ts recent |
NFS Performance and Troubleshooting
|
$ nfsstat -m |
Find processes blocking an unmount:
|
# fuser -vm /mnt/projects |
Common interpretations:
- Permission denied can mean a wrong export path, client outside the export allow-list, root squashing, a mismatched security flavour, or application identity failure.
- Unexpected ownership usually indicates numeric UID/GID inconsistency or NFSv4 identity mapping, not packet loss.
- Stale file handle normally requires the server export or underlying file identity to be corrected; remount only after the server issue is resolved.
- server not responding requires checking DNS, route, TCP 2049, firewall, loss, and server health.
- NFSv3 can require additional portmapper, mountd, lockd, and statd ports. Prefer NFSv4 where architecture and compatibility permit.
firewalld, nftables, SELinux, and Network Security
The Linux kernel netfilter framework performs filtering, connection tracking, NAT, and packet modification. On RHEL and Oracle Linux, firewalld is the normal host-firewall manager. It commonly uses nftables as its backend. The nft command is the native low-level interface for administrators who intentionally own the complete ruleset.
Do not manage the same host concurrently with firewalld and the nftables.service persistent ruleset. Firewalld-created nftables objects are normal and should not be mistaken for a second firewall. Choose one configuration owner, then use packet captures, counters, and socket inspection to verify behaviour.
SELinux is separate from the packet firewall. A packet can reach a listening process and still be denied by SELinux, or the firewall can block a port that SELinux permits. Check both layers.
Inspect Existing Firewall and Security State
|
$ systemctl is-enabled firewalld |
Show the zone associated with a NetworkManager profile:
|
$ nmcli -f connection.id,connection.interface-name,connection.zone connection show LAN |
Listening versus permitted: a listening socket does not prove that remote packets are accepted. An allow rule does not prove that a service is running or bound to the expected address. Check ss, firewalld/nftables, SELinux, and packet flow.
Runtime and Permanent firewalld Configuration
Firewalld maintains two configurations:
- Runtime rules take effect immediately and disappear at reload or reboot.
- Permanent rules are stored on disk and take effect after reload, restart, or reboot.
Safely test a rule at runtime, then persist it:
|
# firewall-cmd –zone=public –add-service=http |
Or create the permanent rule and reload:
|
# firewall-cmd –permanent –zone=public –add-service=http |
A reload replaces runtime-only changes with the permanent configuration. Record important runtime changes before reloading.
Enable firewalld Without Losing Remote Access
When firewalld is already running, add the management rule to both runtime and permanent state before changing zones or defaults:
|
# firewall-cmd –zone=public –add-rich-rule=’rule family=”ipv4″ source address=”192.0.2.0/24″ service name=”ssh” accept’ |
When the service is stopped, prepare the permanent configuration offline:
|
# firewall-offline-cmd –set-default-zone=public |
Warning: A broad predefined ssh service permits SSH from every source in the zone. Replace it with a source-limited rich rule when policy requires restricted administration. Keep the existing session open and test a second login before closing it.
Manage Zones and Interface Assignment
List zones and assign a profile persistently:
|
# firewall-cmd –get-zones |
Assign an interface directly when NetworkManager does not own it:
|
# firewall-cmd –permanent –zone=internal –change-interface=enp1s0 |
Prefer the NetworkManager connection.zone property for NetworkManager-managed interfaces so the correct zone follows profile activation.
Common zones include:
|
Zone |
Typical intent |
|
trusted |
Accept all traffic; use only for fully trusted paths. |
|
internal |
Internal networks with selected services. |
|
public |
Untrusted network with explicitly allowed services. |
|
external |
Router-facing network, commonly with masquerading. |
|
dmz |
Limited services exposed to less-trusted networks. |
|
block |
Reject incoming connections except established/related traffic. |
|
drop |
Silently drop unsolicited incoming traffic. |
Zone names are policy labels, not automatic security guarantees. Inspect the actual services, ports, protocols, sources, forwarding, and rich rules.
List and Manage Services, Ports, and Rules
|
# firewall-cmd –zone=public –list-services |
Add and remove services or ports:
|
# firewall-cmd –permanent –zone=public –add-service=https |
Inspect predefined service definitions:
|
$ firewall-cmd –get-services |
Create a custom service for TCP 8443 and UDP 8443:
|
# firewall-cmd –permanent –new-service=example-app |
Allow Traffic – firewalld Examples
Allow web traffic in the public zone:
|
# firewall-cmd –permanent –zone=public –add-service=http |
Allow SSH only from the management subnet:
|
# firewall-cmd –permanent –zone=public \ |
Allow TCP 5432 only from an application subnet through VLAN 100 by assigning the VLAN to an internal zone and using a rich rule:
|
# nmcli connection modify vlan100 connection.zone internal |
Allow NFSv4 from one subnet:
|
# firewall-cmd –permanent –zone=internal \ |
Allow VRRP for keepalived peers:
|
# firewall-cmd –permanent –zone=internal –add-protocol=vrrp |
Rate-limit new SSH accepts from a subnet:
|
# firewall-cmd –permanent –zone=public \ |
Rate limiting is not an authentication control. Use keys, strong policy, logging, and an upstream protection strategy as appropriate.
Block or Reject Traffic – firewalld Examples
Remove an unnecessary service:
|
# firewall-cmd –permanent –zone=public –remove-service=cockpit |
Drop all traffic from a source:
|
# firewall-cmd –permanent –zone=public \ |
Reject Telnet with an explicit response:
|
# firewall-cmd –permanent –zone=public \ |
Block IPv4 echo requests only when policy requires it:
|
# firewall-cmd –permanent –zone=public –add-icmp-block=echo-request |
Do not broadly block ICMP or ICMPv6. Error reporting, neighbour discovery, router discovery, duplicate-address detection, and path-MTU discovery depend on specific types.
Remove a rich rule by repeating it exactly with –remove-rich-rule:
|
# firewall-cmd –permanent –zone=public \ |
Forwarding, Policies, NAT, and Port Forwarding
Enable kernel forwarding first, as described in the routing section. Use a firewalld policy to permit traffic from an internal zone to an external zone:
|
# firewall-cmd –permanent –new-policy=internal-to-external |
Enable IPv4 masquerading on the external zone:
|
# firewall-cmd –permanent –zone=external –add-masquerade |
Forward external TCP port 8080 to an internal web server on port 80:
|
# firewall-cmd –permanent –zone=external \ |
Verify:
|
# firewall-cmd –zone=external –query-masquerade |
NAT can hide source addresses and complicate logs, access controls, and troubleshooting. Use routing without NAT when the network design supports it.
Logging and Firewall Diagnostics
Enable logging of denied packets at an appropriate rate:
|
# firewall-cmd –set-log-denied=all |
Disable after the diagnostic window if the volume is excessive:
|
# firewall-cmd –set-log-denied=off |
Trace a failed connection with state from several layers:
|
$ ss -lntup | grep ‘:8443’ |
Packet counters that remain at zero can prove that a rule is not being reached. Use nft -a to display handles and counters in the backend ruleset, but make policy changes through firewall-cmd while firewalld owns the rules.
Native nftables Management
Use native nftables when the host requires a directly maintained ruleset and firewalld is not the owner:
|
# systemctl disable –now firewalld |
Example /etc/sysconfig/nftables.conf:
|
flush ruleset table inet filter { chain input { ct state invalid drop ip protocol icmp accept ip saddr @management_v4 tcp dport 22 ct state new accept limit rate 5/second counter log prefix “nft-input-drop: ” drop chain forward { chain output { |
Validate before loading:
|
# nft –check –file /etc/sysconfig/nftables.conf |
Keep console access when testing a default-drop ruleset. A successful syntax check does not prove that the policy preserves management access.
List, Add, Replace, and Delete nftables Rules
|
# nft list tables |
Delete by the handle shown with -a:
|
# nft -a list chain inet filter input |
Interactive changes disappear when the persistent file is reloaded or the host reboots. Add intended rules to the file and validate the entire ruleset.
nftables Allow, Block, Egress, and NAT Examples
|
# nft insert rule inet filter input iifname “vlan100” \ |
Example forwarding and masquerade table:
|
table inet forward_filter { table ip nat { |
SELinux Network Controls
Inspect enforcement and recent denials:
|
$ getenforce |
List port labels:
|
# dnf install -y policycoreutils-python-utils |
Permit sshd to bind TCP 2222 by assigning the correct SELinux port type:
|
# semanage port -a -t ssh_port_t -p tcp 2222 |
Modify an existing custom port mapping with -m, and delete only a locally added mapping with -d.
Permit a confined web server to initiate network connections when required:
|
$ getsebool httpd_can_network_connect |
Use the narrowest relevant boolean, such as a database-specific or NFS-specific boolean, rather than enabling broad access. Do not disable SELinux to resolve a network error; identify the denial and correct the port label, file label, or boolean.
Selected Kernel Network Security Controls
Inspect current values:
|
$ sysctl net.ipv4.conf.all.rp_filter |
Example /etc/sysctl.d/70-network-security.conf for a non-router host:
|
net.ipv4.conf.all.accept_redirects = 0 |
Reverse-path filtering requires design-specific care:
- rp_filter=1 is strict and can drop valid asymmetric or policy-routed traffic.
- rp_filter=2 is loose and accepts a packet if the source is reachable through any interface.
- rp_filter=0 disables the check.
Do not copy a strict value onto multihomed, VPN, container, or policy-routing hosts without testing return paths.
Traffic Flow, Bandwidth, and Resource Control
Linux traffic control (tc) manages queueing, classification, shaping, policing, and network emulation. It normally controls egress directly. Ingress shaping usually redirects traffic to an Intermediate Functional Block (IFB) device.
Inspect Queueing Disciplines and Counters
|
$ tc qdisc show |
Before replacing a qdisc, record the original. noqueue is normal for some virtual devices; fq_codel, fq, or mq can be normal for physical devices depending on release and driver.
Use Fair Queueing with Controlled Delay
|
# tc qdisc replace dev enp1s0 root fq_codel |
Remove the custom root qdisc and return to the device default:
|
# tc qdisc del dev enp1s0 root |
Fair queueing reduces latency under load but does not create a hard bandwidth ceiling.
Limit Egress Bandwidth with Token Bucket Filter
Limit egress to approximately 100 Mbit/s:
|
# tc qdisc replace dev enp1s0 root tbf \ |
Remove the limit:
|
# tc qdisc del dev enp1s0 root |
Choose a burst large enough for the intended rate and timer resolution. An undersized burst can reduce throughput below the configured rate.
Classify Traffic with HTB
Create a 100 Mbit/s root with a 30 Mbit/s class for destination TCP port 22 and a default class:
|
# tc qdisc replace dev enp1s0 root handle 1: htb default 30 |
Classification is direction-sensitive. On egress, destination port matches outbound packets. Return traffic may have source port 22 and require a separate filter depending on the goal.
Emulate Delay, Loss, Duplication, and Reordering
Use only in a controlled test environment:
|
# tc qdisc replace dev enp1s0 root netem delay 100ms 20ms distribution normal |
Warning: Applying netem to the management interface immediately degrades the administrative session and every service using the link.
Shape Ingress with an IFB Device
|
# modprobe ifb numifbs=1 |
Remove the ingress setup:
|
# tc qdisc del dev enp1s0 ingress |
Persist a Traffic-Control Policy
NetworkManager versions expose tc.qdiscs and tc.tfilters connection settings, but syntax and supported classifiers vary. Inspect local documentation before using them:
|
$ man nm-settings-nmcli |
A simple alternative is a dedicated systemd oneshot unit. Example /etc/systemd/system/limit-enp1s0.service:
|
[Unit] [Service] [Install] |
Measure Throughput with iperf3
On the receiving host:
|
$ iperf3 -s |
On the client:
|
$ iperf3 -c 198.51.100.20 |
- -P 8 creates multiple flows and is useful for LACP hashing tests.
- -R reverses the test direction.
- UDP tests report loss and jitter but can intentionally overload the path.
Do not interpret an iperf result without CPU, offload, retransmission, and interface-error context. The bottleneck can be encryption, virtualisation, storage, CPU frequency, a single flow, or the remote host rather than line rate.
Per-Service Network Accounting and Address Restrictions
Enable systemd IP accounting temporarily for a service:
|
# systemctl set-property example.service IPAccounting=yes |
Restrict a service with unit properties where supported by the systemd/cgroup/BPF stack. Example drop-in:
|
[Service] |
These restrictions apply to sockets used by the service’s cgroup and are independent of the host firewall. Test DNS, loopback, logging, and dependent services before enforcing a deny-all policy.
Network Namespace Isolation Example
|
# ip netns add lab |
Namespaces isolate interfaces, routes, neighbour tables, sockets, and many sysctls. External access additionally requires forwarding, firewall policy, and possibly NAT.
Monitoring Traffic and Collecting Performance Metrics
A useful network baseline combines interface counters, driver counters, queue statistics, socket state, protocol statistics, packet captures, and historical metrics. One tool rarely explains a performance issue by itself.
Interface Counters
|
$ ip -s link show dev enp1s0 |
Look for increasing receive/transmit errors, drops, missed packets, CRC/FCS errors, carrier changes, queue timeouts, and no-buffer counters. Driver counter names are vendor-specific; compare the rate of change rather than relying only on one absolute number.
Watch counters every second:
|
$ watch -n 1 ‘ip -s link show dev enp1s0’ |
Interactive Bandwidth and Flow Tools
Repository availability varies by release and enabled repositories:
|
# dnf install -y iftop nload bmon vnstat |
Examples:
|
# iftop -i enp1s0 -nNP |
iftop shows conversations, nload shows aggregate rates, bmon shows interface counters, and vnstat stores long-term totals. These tools are useful for orientation but do not replace packet captures or application metrics.
Packet Capture with tcpdump
Basic interface capture without name or service resolution:
|
# tcpdump -ni enp1s0 |
Useful filters:
|
# tcpdump -ni enp1s0 host 198.51.100.20 |
Save full packets for later analysis:
|
# tcpdump -ni enp1s0 -s 0 -w /var/tmp/network.pcap ‘host 198.51.100.20’ |
Rotate bounded capture files:
|
# tcpdump -ni enp1s0 -s 0 -C 100 -W 10 \ |
-C 100 rotates near 100 MB and -W 10 retains ten files. Packet captures can contain credentials, tokens, personal data, and proprietary payloads even when application encryption hides content. Protect, transfer, and delete them according to policy.
Capture both sides of a host when diagnosing forwarding, NAT, VLAN, bond, or asymmetric-path problems:
|
# tcpdump -ni enp1s0 -w /var/tmp/inside.pcap host 198.51.100.20 |
Monitor Sockets and TCP Health
|
$ ss -s |
ss -ti can expose congestion control, RTT, retransmissions, pacing, cwnd, and delivery-rate information for TCP sockets.
Protocol counters:
|
$ nstat -az |
Take two snapshots and compare counter deltas during the problem rather than interpreting lifetime totals without context.
Collect Current and Historical Metrics with sysstat
|
# dnf install -y sysstat |
Live samples:
|
$ sar -n DEV 1 |
Historical examples:
|
$ sar -n DEV -f /var/log/sa/sa14 |
- DEV reports throughput and packets by interface.
- EDEV reports errors, drops, collisions, and overruns.
- TCP and ETCP show connection and retransmission activity.
- CPU and interrupt pressure should be reviewed alongside network rates.
Performance Co-Pilot
PCP provides live and archived metrics with a consistent namespace:
|
# dnf install -y pcp pcp-system-tools |
Discover exact metric names on the installed version:
|
$ pminfo | grep -E ‘^network\.|^kernel\.all\.network’ |
Archive analysis is valuable for intermittent incidents that finish before an administrator connects. Verify that pmlogger retention and storage match operational requirements.
Optional eBPF and Socket-Tracing Tools
When repositories and kernel support provide them:
|
# dnf install -y bcc-tools bpftrace bpftool |
Common tools can include:
|
# tcpconnect |
Tool names and packaging vary by release and kernel. On Oracle Linux, UEK and RHCK can expose different probe support. Use eBPF tools carefully on production systems and validate their overhead.
Create a Repeatable Performance Baseline
Record idle and loaded measurements:
|
$ date -Ins |
Then run a controlled throughput test and repeat. A baseline makes later deviations visible and helps distinguish a network change from a workload, CPU, driver, firmware, or virtualisation change.
Troubleshooting Workflow and Common Tools
Troubleshooting is faster when each layer is tested in order and evidence is collected before restarting services. Begin with the smallest failing scope: one interface, one address, one path, one protocol, and one time window.
Step-by-Step Network Troubleshooting
- Confirm the intended interface and NetworkManager profile.
- Confirm hardware, driver, carrier, speed, duplex, MTU, and errors.
- Confirm VLAN, bridge, bond, MAC, and neighbour state.
- Confirm IP address, prefix, source selection, routes, and policy rules.
- Test the local gateway and a remote IP address.
- Test DNS/NSS separately from raw IP reachability.
- Confirm the server socket, firewall, SELinux, and application protocol.
- Capture packets on the relevant interfaces and correlate timestamps with logs.
A compact first pass:
|
$ nmcli device status |
ping – Reachability, Latency, Loss, and MTU
|
$ ping -c 4 192.0.2.1 |
Control interval and deadline:
|
$ ping -c 10 -i 0.2 -w 5 198.51.100.20 |
Probe path MTU:
|
$ ping -c 3 -M do -s 1472 198.51.100.20 |
The 1472-byte payload plus IPv4 and ICMP headers tests a 1500-byte IP packet. VLAN/Ethernet framing is outside that calculation. Reduce the payload until it succeeds, then investigate the path component with the smaller MTU.
Interpretation:
|
Observation |
Likely direction |
|
Local gateway does not reply |
Link, VLAN, address/prefix, ARP, switch, or gateway filtering. |
|
Gateway replies but remote IP does not |
Upstream route, firewall, remote host, or return path. |
|
Remote IP replies but name fails |
DNS/NSS, not general IP connectivity. |
|
Small payload succeeds but large DF payload fails |
Path-MTU discovery or MTU mismatch. |
|
Variable high RTT and loss |
Congestion, Wi-Fi quality, queueing, errors, duplex, or remote load. |
A host can block echo while allowing the intended service, so ping failure is not final proof that the service is unreachable.
arp, ip neighbour, and arping
The arp command from net-tools is legacy:
|
$ arp -n |
Preferred neighbour-table commands:
|
$ ip neigh show |
Neighbour states:
|
State |
Meaning |
|
REACHABLE |
Recently confirmed reachable. |
|
STALE |
Entry is valid but not recently confirmed; normal until used. |
|
DELAY / PROBE |
Kernel is actively confirming reachability. |
|
INCOMPLETE |
Resolution request sent; no MAC learned yet. |
|
FAILED |
Resolution attempts failed. Check subnet, VLAN, peer, and switch path. |
|
PERMANENT |
Static entry that is not normally aged. |
Probe a neighbour or duplicate address:
|
# arping -I enp1s0 -c 3 192.0.2.1 |
Delete one stale entry and allow relearning:
|
# ip neigh del 192.0.2.1 dev enp1s0 |
Flushing an entire neighbour table can interrupt active traffic and conceal the original evidence. Delete only the affected entry unless a full flush is deliberate.
traceroute and tracepath – Path Discovery
|
$ traceroute -n 198.51.100.20 |
- Default traceroute commonly sends UDP probes.
- -I uses ICMP echo.
- -T uses TCP and can follow the same firewall path as an application port.
- tracepath does not normally require root and reports discovered path MTU.
Asterisks indicate no response to that probe, not necessarily packet loss at that router. Many routers forward traffic while rate-limiting or filtering TTL-expired replies.
nc / ncat – TCP and UDP Port Testing
Test a TCP connection:
|
$ nc -vz -w 3 198.51.100.20 443 |
Listen temporarily on a test port:
|
$ nc -l 8443 |
From another host:
|
$ printf ‘test\n’ | nc -w 3 192.0.2.10 8443 |
UDP test:
|
$ nc -vzu -w 3 192.0.2.53 53 |
A UDP succeeded message often means no immediate ICMP error was received; it does not prove that the application accepted or replied to the datagram. Use a protocol-aware query and packet capture.
ss – Socket and Connection Inspection
|
$ ss -lntup |
Interpret common TCP conditions:
- SYN-SENT accumulating on a client suggests no SYN-ACK, routing failure, silent filtering, or remote outage.
- SYN-RECV accumulating on a server can indicate backlog pressure, an attack, or return-path problems.
- Immediate ECONNREFUSED generally means a TCP reset from the host or an active firewall reject.
- Many retransmissions with an established socket indicate loss, congestion, MTU, or severe receiver/application delay.
dig and getent – DNS and NSS
|
$ getent ahosts app.example.com |
Compare results. When dig succeeds but getent fails, inspect /etc/nsswitch.conf, /etc/resolv.conf, search domains, local hosts, SSSD, and any local resolver.
tcpdump – Packet-Level Evidence
Observe a TCP handshake:
|
# tcpdump -ni enp1s0 ‘host 198.51.100.20 and tcp port 443’ |
Handshake patterns:
|
Packet pattern |
Interpretation |
|
SYN, SYN-ACK, ACK |
TCP path and handshake succeeded. Continue at TLS/application layer. |
|
Repeated SYN, no reply |
Silent drop, route/return-path problem, or destination down. |
|
SYN followed by RST |
Host reached but no listener, active reject, or application reset. |
|
SYN-ACK seen leaving server but not at client |
Return-path or intermediate filtering problem. |
|
Repeated retransmissions after establishment |
Loss, congestion, MTU, receiver, or application stall. |
Capture DNS plus the resulting connection to correlate name and application behaviour:
|
# tcpdump -ni any ‘port 53 or (host 198.51.100.20 and tcp port 443)’ |
curl, openssl, and Application-Layer Tests
HTTP/TLS detail:
|
$ curl -v –connect-timeout 5 https://app.example.com/ |
–resolve tests a specific address while preserving the HTTP Host header and TLS server name.
Inspect the TLS handshake and certificate chain:
|
$ openssl s_client -connect app.example.com:443 \ |
Application tests distinguish a successful TCP handshake from HTTP redirects, TLS trust errors, proxy policy, authentication failures, or server-side delays.
mtr – Continuous Path Testing
|
$ mtr -rwzc 100 198.51.100.20 |
Loss shown at an intermediate hop is meaningful only when it continues to later hops. A router can rate-limit diagnostic responses while forwarding transit traffic normally.
Troubleshooting Common Scenarios
Interface Missing
|
$ ip link |
Check whether the device is physically detected, the expected driver is present, firmware loaded, the name changed, the interface moved to a namespace, or a virtual device was not recreated.
Interface Present but No Carrier
|
$ ip -br link show enp1s0 |
Check cable, optic, transceiver support, switch port state, speed/autonegotiation compatibility, radio block, and driver resets.
DHCP Does Not Obtain an Address
|
$ nmcli device status |
No DHCP discover usually means the profile is not active, device is unmanaged, or lower-layer state is wrong. Discover without offer points to VLAN, relay, server, scope, or filtering. Offer without successful request/ack can indicate duplicate-address detection, server policy, or client/profile conflict.
Local Subnet Peer Is Unreachable
|
$ ip address show dev enp1s0 |
Focus on prefix length, VLAN, duplicate address, ARP/NDP, bridge/bond membership, switch isolation, and host firewall.
Internet Works by Address but Not by Name
|
$ ping -c 2 198.51.100.20 |
Remote Service Is Unreachable
Client:
|
$ ip route get 198.51.100.20 |
Server:
|
$ ss -lntp ‘sport = :443’ |
Intermittent Freezes or MTU Black Hole
|
$ tracepath 198.51.100.20 |
Look for large-packet retransmissions, missing ICMP fragmentation-needed or packet-too-big messages, tunnels, VLANs, VPN overhead, and inconsistent jumbo-frame settings.
Slow Throughput
|
$ ethtool enp1s0 |
Check negotiated speed, duplex, CRC/errors, drops, retransmissions, queue pressure, CPU saturation, IRQ distribution, offload settings, single-flow limits, virtualisation, and remote bottlenecks.
VLAN Traffic Fails
|
$ ip -d link show vlan100 |
Confirm parent, VLAN ID, trunk allowance, native VLAN, bond placement, MTU, and IP prefix. Compare capture on both parent and VLAN interface.
Bond or LACP Fails Over Incorrectly
|
$ cat /proc/net/bonding/bond0 |
For active-backup, verify monitoring, primary policy, VLAN parity, MAC movement, and switch security. For LACP, verify partner keys, aggregator IDs, collecting/distributing state, switch channel, and multi-chassis support.
Asymmetric Routing or Reverse-Path Filtering
|
$ ip rule show |
Capture both ingress and egress. A packet can arrive on one interface while the kernel’s reverse route points to another, causing strict reverse-path filtering or a stateful firewall to drop it.
Common Errors and Focused Fixes
|
Problem |
Likely explanation |
Focused action |
|
Network is unreachable |
No matching route or no usable interface address |
ip route get; inspect address, connected route, default route, and rules. |
|
Destination Host Unreachable from local host |
Neighbour resolution or local route failed |
ip neigh, arping, VLAN, prefix, peer, switch path. |
|
Connection refused |
Destination returned TCP RST or firewall reject |
Check server listener, bind address, service state, reject rules. |
|
Connection timeout |
Silent filtering, loss, route failure, return path, or application stall |
Capture both ends; inspect routes, firewall, and service. |
|
RTNETLINK answers: File exists |
Conflicting existing address, route, rule, or device |
Show the exact object; delete or use replace. |
|
Temporary failure in name resolution |
Resolver unavailable, wrong ownership, or DNS path failure |
getent, resolv.conf, NetworkManager DNS, direct dig. |
|
Address already in use |
Duplicate IP or local socket bind conflict |
arping -D, ip address, ss -lntup, IP inventory. |
|
No such device |
Wrong/renamed interface, namespace move, or missing driver |
ip link, udevadm, lspci -k, kernel logs. |
|
Operation not supported |
Driver, hardware, kernel, or manager lacks requested feature |
ethtool -i/-k, local docs, alternate mode. |
|
NetworkManager activation failed |
Invalid profile, carrier/DHCP failure, duplicate address, dependency |
nmcli con up, journalctl -u NetworkManager, validate profile. |
|
NFS server not responding |
DNS, route, TCP 2049, firewall, loss, or server outage |
getent, nc, mount -v, nfsstat, packet capture. |
|
LDAP certificate verify failed |
CA, name, expiration, or clock mismatch |
openssl s_client, CA trust, DNS name, Chrony. |
|
Firewalld rule appears ineffective |
Wrong zone, runtime/permanent mismatch, rule order, no listener |
Active zones, –list-all-zones, nft counters, ss. |
|
SELinux denial |
Process or port type not authorised |
ausearch, semanage port, relevant boolean or label. |
Collect a Network Diagnostic Snapshot
|
# out=/var/tmp/network-snapshot-$(date +%F-%H%M%S) |
Sanitise addresses, profile secrets, DNS names, LDAP data, packet captures, and logs before sharing outside the authorised support path.
For a broader support archive, install and run sos:
|
# dnf install -y sos |
The sos archive can contain sensitive configuration and logs. Handle it as confidential operational data.
Command Reference Summary
|
Task |
Command |
|
List interfaces and addresses |
ip -br link; ip -br address |
|
Show NetworkManager devices |
nmcli device status |
|
Show active profiles |
nmcli connection show –active |
|
Detailed interface state |
ip -s -d link show dev enp1s0 |
|
Driver, firmware, and bus |
ethtool -i enp1s0 |
|
Link speed and duplex |
ethtool enp1s0 |
|
Wireless state |
iw dev; iw dev wlp2s0 link; rfkill list |
|
Current/permanent MAC |
ip link show enp1s0; ethtool -P enp1s0 |
|
Add/delete temporary address |
ip addr add PREFIX dev IFACE; ip addr del PREFIX dev IFACE |
|
Create static NetworkManager profile |
nmcli con add type ethernet ifname IFACE con-name NAME ipv4.method manual … |
|
Create DHCP profile |
nmcli con add type ethernet ifname IFACE con-name NAME ipv4.method auto |
|
Add a VLAN |
nmcli con add type vlan ifname vlan100 vlan.parent enp1s0 vlan.id 100 |
|
Inspect bond |
cat /proc/net/bonding/bond0 |
|
List all routes/rules |
ip route show table all; ip -6 route show table all; ip rule |
|
Explain route choice |
ip route get DEST from SOURCE |
|
Add/replace default route |
ip route replace default via GATEWAY dev IFACE metric N |
|
Add/delete static route |
ip route add PREFIX via GATEWAY; ip route del PREFIX via GATEWAY |
|
Show neighbours |
ip neigh show; ip -6 neigh show |
|
Duplicate IPv4 probe |
arping -D -I IFACE -c 3 ADDRESS |
|
Show resolver inputs |
cat /etc/resolv.conf; nmcli -f IP4.DNS,IP4.DOMAIN device show |
|
DNS through NSS |
getent ahosts NAME |
|
Direct DNS query |
dig @SERVER NAME TYPE |
|
Chrony status |
chronyc tracking; chronyc sources -v |
|
LDAP identity test |
getent passwd USER; id USER; sssctl user-checks USER |
|
NFS mount state |
findmnt; nfsstat -m; nfsiostat 1 |
|
List firewall zones |
firewall-cmd –get-active-zones; firewall-cmd –list-all-zones |
|
List native ruleset |
nft -a list ruleset |
|
Listening sockets |
ss -lntup |
|
TCP port test |
nc -vz -w 3 HOST PORT |
|
TCP path trace |
traceroute -T -p PORT -n HOST |
|
Path MTU |
tracepath HOST; ping -M do -s SIZE HOST |
|
Packet capture |
tcpdump -ni IFACE FILTER |
|
Interface metrics |
ip -s link; ethtool -S IFACE; sar -n DEV,EDEV 1 |
|
TCP metrics |
ss -ti; nstat -az; sar -n TCP,ETCP 1 |
|
Queue metrics |
tc -s qdisc show dev IFACE |
|
Throughput test |
iperf3 -c HOST -P 8 |
|
Follow network logs |
journalctl -fu NetworkManager |
|
Declarative state |
nmstatectl show; nmstatectl apply FILE.yml |
Quick Layer-to-Tool Reference
|
Layer or service |
Interrogate |
Configure or manage |
|
Physical Ethernet |
lspci, lshw, ethtool, kernel journal |
Driver/firmware, ethtool, NetworkManager link properties |
|
Wireless physical/link |
iw phy, iw dev, rfkill, nmcli wifi |
nmcli, nmtui, rfkill, regulatory policy |
|
Data link |
ip -s -d link, bridge, ip neigh |
ip link, nmcli, Nmstate, bridge/bond/VLAN profiles |
|
VLAN |
ip -d link, bridge vlan, tcpdump -e |
NetworkManager VLAN profile, Nmstate |
|
Bond/LACP |
/proc/net/bonding, ip -d link |
NetworkManager bond and port profiles, switch LAG |
|
IPv4/IPv6 address |
ip address, nmcli device show |
ip address, NetworkManager, Nmstate |
|
Routing |
ip route, ip rule, ip route get |
ip route/rule, NetworkManager routes/rules, Nmstate |
|
TCP/UDP |
ss, nc, tcpdump, nstat |
Application bind, firewalld/nftables, sysctl, tc |
|
DNS |
getent, dig, resolver files, nmcli |
NetworkManager DNS, local resolver, NSS, hosts |
|
NTP |
timedatectl, chronyc |
/etc/chrony.conf, chronyd |
|
LDAP |
ldapsearch, getent, id, sssctl |
SSSD, authselect, CA trust |
|
NFS |
findmnt, nfsstat, nfsiostat, tcpdump |
mount, /etc/fstab, autofs, SELinux booleans |
|
Firewall |
firewall-cmd, nft, counters, logs |
firewalld or native nftables, not both as owners |
|
SELinux |
getenforce, ausearch, semanage |
Port types, booleans, labels, policy |
|
Performance |
sar, PCP, ethtool -S, ss -ti, tc -s |
tc, qdiscs/classes, systemd IP accounting |
Final Notes
Network troubleshooting becomes predictable when each layer is verified before the next. Begin with hardware and carrier, then data-link state, address and prefix, neighbour discovery, route selection, DNS, transport sockets, firewall/SELinux policy, and finally the application protocol.
For persistent configuration on current systems, use NetworkManager profiles through nmcli, nmtui, Cockpit, Nmstate, or automation. Treat ifcfg examples as migration references for RHEL and Oracle Linux 8, not as the design target for 9 or 10. Use bonds rather than teams for new deployments.
Before every remote networking or firewall change, capture the working state, preserve console access, make one change at a time, and verify the running kernel state rather than trusting only the saved configuration.
Authoritative References
- Red Hat Enterprise Linux 10 – Configuring and managing networking: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/configuring_and_managing_networking/
- Red Hat Enterprise Linux 10 – Network troubleshooting and performance tuning: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/network_troubleshooting_and_performance_tuning/
- Red Hat Enterprise Linux 10 – Configuring firewalls and packet filters: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/configuring_firewalls_and_packet_filters/
- Red Hat Enterprise Linux 10 – Configuring time synchronization: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/configuring_time_synchronization/
- Red Hat Enterprise Linux 10 – Configuring authentication and authorization: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/configuring_authentication_and_authorization_in_rhel/
- Red Hat Enterprise Linux 10 – Configuring and using network file services: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/configuring_and_using_network_file_services/
- Red Hat Enterprise Linux 9 – Configuring and managing networking: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/configuring_and_managing_networking/
- Red Hat Enterprise Linux 8 – Configuring and managing networking: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/
- Oracle Linux 10 – Setting Up Networking With NetworkManager: https://docs.oracle.com/en/operating-systems/oracle-linux/10/network/
- Oracle Linux 9 – Setting Up Networking: https://docs.oracle.com/en/operating-systems/oracle-linux/9/network/
- Oracle Linux 8 – Setting Up Networking: https://docs.oracle.com/en/operating-systems/oracle-linux/8/network/
- Oracle Linux – Configuring the Firewall: https://docs.oracle.com/en/operating-systems/oracle-linux/9/firewall/
- NetworkManager command-line documentation: man nmcli, man nm-settings-nmcli, man NetworkManager.conf
- iproute2 documentation: man ip, man ip-link, man ip-address, man ip-route, man ip-rule, man ss, man tc
- Ethernet and driver documentation: man ethtool
- firewalld and nftables documentation: man firewall-cmd, man firewalld.richlanguage, man nft
- SSSD and LDAP documentation: man sssd.conf, man sssd-ldap, man authselect, man ldapsearch
- NFS documentation: man nfs, man nfs.conf, man mount.nfs, man autofs
Check out our other Cheat Sheets and Blogs and if you would like us to write a cheat sheet for you, for FREE, (and we find it suitable) Contact Us.