This Linux tutorial covers TCP/IP networking, network administration and system configuration basics.
Linux can support multiple network devices. The device names are numbered
and begin at zero and count upwards. For example, a computer running two
ethernet cards will have two devices labeled /dev/eth0 and
/dev/eth1.
Linux network configuration, management, monitoring and system tools are covered in this tutorial.
List DNS servers for internet domain name resolution
/etc/hosts
Lists hosts to be resolved locally (not by DNS)
/etc/nsswitch.conf
List order of host name search. Typically look at local files, then NIS server, then DNS server.
Red Hat/Fedora/CentOS: /etc/sysconfig/network
Specify network configuration. eg. Static IP, DHCP, NIS, etc.
Red Hat/Fedora/CentOS: /etc/sysconfig/network-scripts/ifcfg-device
Specify TCP network information.
Ubuntu/Debian: /etc/network/interfaces
Specify network configuration and devices. eg. Static IP and info, DHCP, etc.
Domain Resolution Configuration Files:
File: /etc/resolv.conf- host name resolver configuration file
search name-of-domain.com - Name of your domain or ISP's domain if using their name server
nameserver XXX.XXX.XXX.XXX - IP address of primary name server
nameserver XXX.XXX.XXX.XXX - IP address of secondary name server
This configures Linux so that it knows which DNS server will be resolving
domain names into IP addresses. If using DHCP client, this will automatically
be sent to you by the ISP and loaded into this file as part of the DHCP protocol. If using a static
IP address, ask the ISP or check another machine on your network.
Red Hat/Fedora GUI: /usr/sbin/system-config-network (select tab "DNS".
File: /etc/hosts- locally resolve node names to IP addresses
This informs Linux of local systems on the network which are
not handled by the DNS server.
(or for all systems in your LAN if you are not using DNS or NIS)
Red Hat/Fedora GUI: /usr/sbin/system-config-network (select tab "Hosts".
File: /etc/nsswitch.conf- System Databases and Name Service Switch configuration file
hosts: files dns nisplus nis
This example tells Linux to first resolve a host name by looking at the
local hosts file(/etc/hosts), then if the name is not found look
to your DNS server as defined by /etc/resolv.conf and if not found there look to your NIS server.
In the past this file has had the following names:
/etc/nsswitch.conf, /etc/svc.conf, /etc/netsvc.conf, ... depending on
the distribution.
Fedora / Red Hat Network Configuration Files:
/etc/sysconfig/network
Red Hat network configuration file used by the system during the boot process.
File: /etc/sysconfig/network-scripts/ifcfg-eth0
Configuration settings for your first ethernet port (0). Your
second port is eth1.
File:
/etc/modprobe.conf (kernel 2.6)
/etc/modules.conf (kernel 2.4)
(or for older systems: /etc/conf.modules)
Example statement for Intel ethernet card:
alias eth0 eepro100
Modules for other devices on the system will also be listed.
This tells the kernel which device driver to use if configured as a
loadable module. (default for Red Hat)
Fedora / Red Hat Network GUI Configuration Tools:
The following GUI tools edit the system configuration files.
There is no difference in the configuration developed with the GUI tools and
that developed by editing system configuration files directly.
Text console configuration tool:
/usr/sbin/system-config-network-tui (Text User Interface (TUI) for Fedora Core 2/3)
/usr/bin/redhat-config-network-tui (RH 9.0 - FC-1)
Text console network configuration tool.
First interface only - eth0: /usr/sbin/netconfig
/usr/bin/netcfg (GUI) (last available with RH 7.1)
Gnome Desktop:
Gnome Desktop Network Configuration
/usr/bin/gnome-network-preferences (RH 9.0 - FC-3)
Proxy configuration. Choose one of three options:
Direct internet connection
Manual proxy configuration (specify proxy and port)
Automatic proxy configuration (give URL)
Assigning an IP address:
Computers may be assiged a static IP address or assigned one dynamically.
Typically a server will require a static IP while a workstation will use DHCP (dynamic IP assignment).
The Linux server requires a static IP so that those who wish to use its resources can find the system.
It is more easily found if the IP address does not change and is static.
This is not important for the Linux client workstation and thus it is easier to use an automated Dynamic Host Configuration Protocol (DHCP) for IP address assignment.
Network address by convention would be the lowest: 192.168.10.0
Broadcast address by convention would be the highest: 192.168.10.255
The gateway can be anything, but following convention: 192.168.10.1
Note: the highest and lowest addresses are based on the netmask.
The previous example is based on a netmask of 255.255.255.0
Red Hat / Fedora GUI tools:
/usr/bin/neat Gnome GUI network administration tool. Handles all interfaces. Configure for Static IP or DHCP client.
(First available with Red Hat 7.2.)
/usr/bin/netcfg (Handles all interfaces) (last available in Red Hat 7.1)
Red Hat / Fedora Console tools:
/usr/sbin/system-config-network-tui (Text User Interface)
/usr/sbin/netconfig (Only seems to work for the first network interface eth0 but not eth1,...)
Directly edit configuration files/scripts. See format below.
The ifconfig command does NOT store this information permanently.
Upon reboot this information is lost.
(Manually add the commands to the end of the
file /etc/rc.d/rc.local to execute them upon boot.)
The commands netcfg and netconfig make permanent changes to system
network configuration files located in /etc/sysconfig/network-scripts/,
so that this information is retained.
The IANA has allocated IP addresses in the range of 192.168.0.0 to 192.168.255.255 for private networks.
lo: Loopback interface (network within your system without slowing down for the real ethernet based network)
eth0: First ethernet interface card
wlan0: First wireless network interface
Also see "man interfaces"
Red Hat / Fedora Core IP Configuration Files:
The Red Hat configuration tools store the configuration information in the file
/etc/sysconfig/network.
They will also allow one to configure routing information.
File: /etc/sysconfig/network
Static IP address Configuration: (Configure gateway address)
NETWORKING=yes HOSTNAME=my-hostname- Hostname is defined here and by command hostname
FORWARD_IPV4=true - True for NAT firewall gateways and linux routers. False for everyone else - desktops and servers.
GATEWAY="XXX.XXX.XXX.YYY" - Used if your network is connected to another network or the internet. Static IP configuration. Gateway not defined here for DHCP client.
OR for DHCP client configuration:
NETWORKING=yes HOSTNAME=my-hostname- Hostname is defined here and by command hostname
(Gateway is assigned by DHCP server.)
OR for NIS client configuration:
NETWORKING=yes HOSTNAME=my-hostname- Hostname is defined here and by command hostname
NISDOMAIN=NISProject1- NIS domain to attach
File (Red Hat/Fedora): /etc/sysconfig/network-scripts/ifcfg-eth0
(S.u.s.e.: /etc/sysconfig/network/ifcfg-eth-id-XX:XX:XX:XX:XX)
This file used by the command scripts ifup and ifdown
Static IP address configuration:
DEVICE=eth0 BOOTPROTO=static BROADCAST=XXX.XXX.XXX.255 IPADDR=XXX.XXX.XXX.XXX
NETMASK=255.255.255.0
NETWORK=XXX.XXX.XXX.0
ONBOOT=yes - Will activate upon system boot
RHEL4/FC3 additions:
TYPE=Ethernet
HWADDR=XX:XX:XX:XX:XX:XX
GATEWAY=XXX.XXX.XXX.XXX
OR for DHCP client configuration:
DEVICE=eth0 ONBOOT=yes BOOTPROTO=dhcp
RHEL4/FC3 additions:
IPV6INIT=no
USERCTL=no
PEERDNS=yes
TYPE=Ethernet
HWADDR=XX:XX:XX:XX:XX:XX
(Used by script /etc/sysconfig/network-scripts/ifup to bring the various network interfaces on-line)
To disable DHCP change BOOTPROTO=dhcp to BOOTPROTO=none
In order for updated information in any of these files to take effect,
one must issue the command: service network restart
(or: /etc/init.d/network restart)
Aliases can also be shut down independently. i.e.: ifdown eth0:0
The option during kernel compile is: CONFIG_IP_ALIAS=y (Enabled by default in Redhat)
Note: The Apache web server can be configured so that different
IP addresses can be assigned to specific domains being hosted.
See Apache configuration and "configuring an IP based virtual host" in the YoLinux Web site configuration tutorial.
DHCP Linux Client: get connection info:/sbin/pump -i eth0 --status
(Red Hat Linux 7.1 and older)
Device eth0 IP: 4.XXX.XXX.XXX Netmask: 255.255.252.0 Broadcast: 4.XXX.XXX.255 Network: 4.XXX.XXX.0 Boot server 131.XXX.XXX.4 Next server 0.0.0.0 Gateway: 4.XXX.XXX.1 Domain: vz.dsl.genuity.net Nameservers: 4.XXX.XXX.1 4.XXX.XXX.2 4.XXX.XXX.3 Renewal time: Sat Aug 11 08:28:55 2001 Expiration time: Sat Aug 11 11:28:55 2001
Activating and De-Activating your NIC:
Commands for starting and stopping TCP/IP network services on a Network Interface Card (NIC):
Activate:/sbin/ifup eth0
(Also: ifconfig eth0 up- Note: Even if no IP address is assigned you can listen.)
Some addresses are reserved and outside this scope. Loopback
(127.0.0.1), reserved class C 192.168.XXX.XXX, reserved class B
172.31.XXX.XXX and reserved class A 10.XXX.XXX.XXX.
Subnet Example:
Your ISP assigns you a subnet mask of 255.255.255.248 for your office.
208.88.34.104 Network Base address
208.88.34.105 Computer 1
208.88.34.106 Computer 2
208.88.34.107 Computer 3
208.88.34.108 Computer 4
208.88.34.109 Computer 5
208.88.34.110 DSL router/Gateway
208.88.34.111 Broadcast address
Of the eight addresses, there are six assigned to hardware systems and ultimately only five usable addresses.
The concept of network classes is a little obsolete as subnets are now used
to define smaller networks. These subnets may be part of a class A, B, C, etc
network. For historical reference the network classes are defined as follows:
Class A: Defined by the first 8 bits with a range of 0 - 127.
First number (8 bits) is defined by Internic i.e. 77.XXX.XXX.XXX
One class A network can define 16,777,214 hosts.
Range: 0.0.0.0 - 127.255.255.255
Class B: Defined by the first 8 bits with a range from 128 - 191
First two numbers (16 bits) are defined by Internic i.e. 182.56.XXX.XXX
One class B network can define 65,534 hosts.
Range: 128.0.0.0 - 191.255.255.255
Class C: Defined by the first 8 bits with a range from 192 - 223
First three numbers (24 bits) are defined by Internic i.e. 220.56.222.XXX
One class B network can define 254 hosts.
Range: 192.0.0.0 - 223.255.255.255
Class D: Defined by the first 8 bits with a range from 224 - 239
This is reserved for multicast networks (RFC988)
Range: 224.0.0.0 - 239.255.255.255
Class E: Defined by the first 8 bits with a range from 240 - 255
This is reserved for experimental use.
Range: 240.0.0.0 - 247.255.255.255
Enable Forwarding:
Forwarding allows the network packets on one network interface (i.e. eth0) to be forwarded to another network interface (i.e. eth1).
This will allow the Linux computer to conect ("ethernet bridge") or route network traffic.
The bridge configuration will merge two (or several) networks
into one single network topology. IpTables firewall rules can be used
to filter traffic.
A router configuration can support multicast and basic IP routing using the "route"
command. IP masquerading (NAT) can be used to connect private local
area networks (LAN) to the internet or load balance servers.
Turn on IP forwarding to allow Linux computer to act as a gateway or router.
echo 1 > /proc/sys/net/ipv4/ip_forward
Default is 0. One can add firewall rules by using ipchains.
Another method is to alter the Linux kernel config file: /etc/sysctl.conf
Set the following value:
net.ipv4.ip_forward = 1
See file /etc/sysconfig/network for storing this configuration.
FORWARD_IPV4=true
Change the default "false" to "true".
All methods will result in a proc file value of "1".
Test: cat /proc/sys/net/ipv4/ip_forward
Manual method:
This does not alter the permanent configuration and will only
configure support until the next reboot.
cd /lib/modules/2.2.5-15/net/ - Use kernel version for your system. This example uses 2.2.5-15
(Fedora Core 3: /lib/modules/2.6.12-1.1381_FC3/kernel/net/)
Here you will find the modules supported by your system.
It can be permanently added to:
/etc/modprobe.conf (kernel 2.6)
/etc/modules.conf (kernel 2.4)
(or for older systems: /etc/conf.modules)
Example:
alias eth0 3c59x
/sbin/insmod 3c59x (For a 3Com ethernet card) This inserts the specified module into the kernel.
/sbin/modprobe 3c59x
This also loads a module into the system kernel.
Modprobe command line options:
-r : to unload the module.
/sbin/modprobe -l \* : list all modules.
/sbin/modprobe -lt net \* : List only network modules
/sbin/modprobe -t net \* : Try loading all network modules and see what sticks. (act of desperation)
ifconfig ...
The easy way: Red Hat versions 6.2 and later, ship with Kudzu, a device detection program
which runs during system initialization. (/etc/rc.d/init.d/kudzu)
This can detect a newly installed NIC and load the appropriate driver.
Then use /usr/sbin/netconfig to configure the IP address and
network settings. The configuration will be stored so that it will be utilized
upon system boot.
Systems with two NIC cards: Typically two cards are used when
connecting to two networks. In this case the device must be defined
using one of three methods:
Use the Red Hat GUI tool /usr/bin/netcfg
OR
Define network parameters in configuration files:
Define new device in file (Red Hat/Fedora) /etc/sysconfig/network-scripts/ifcfg-eth1
(S.u.s.e 9.2: /etc/sysconfig/network/ifcfg-eth-id-XX:XX:XX:XX:XX)
Special routing information may be specified, if necessary, in the
file
(Red Hat/Fedora): /etc/sysconfig/static-routes
(S.u.s.e. 9.2: /etc/sysconfig/network/routes)
Example:
eth1 net XXX.XXX.XXX.0 netmask 255.255.255.0 gw XXX.XXX.XXX.XXX
OR
Define network parameters using Unix command line interface:
Queries ethernet device for rx/tx ring parameter information.
ethtool -a eth0
Queries ethernet device for pause parameter information.
ethtool -c eth0
Queries ethernet device for coalescing information.
ethtool -i eth0
Queries ethernet device for associated driver information.
ethtool -d eth0
Prints a register dump for the specified ethernet device.
ethtool -k eth0
Queries ethernet device for offload information.
ethtool -S eth0
Queries ethernet device for NIC and driver statistics.
Man Pages:
mii-tool - view, manipulate media-independent interface status
ethtool - Display or change ethernet card settings
Route:
Static routes: IP (Internet Protocol) uses a routing table to determine
where packets should be sent. First the packet is examined to see if its'
destination is for the local or remote network. If it is to be sent to a
remote network, the routing table is consulted to determine the path.
If there is no information in the routing table then the packet is sent to the
default gateway.
Static routes are set with the route command and with the configuration file
(Red Hat/Fedora): /etc/sysconfig/network-scripts/route-eth0
or
(Red Hat 7: /etc/sysconfig/static-routes)
(S.u.s.e. 9.2: /etc/sysconfig/network/routes):
10.2.3.0/16 via 192.168.10.254
See command: /etc/sysconfig/network-scripts/ifup-routes eth0
Dynamic routes: RIP (Routing Information Protocol) is used to define dynamic
routes. If multiple routes are possible, RIP will choose the shortest route.
(Fewest hops between routers not physical distance.)
Routers use RIP to broadcast the routing table over UDP port 520.
The routers would then add new or improved routes to their routing tables.
Man pages:
route - show / manipulate the IP routing table (Static route)
Examples:
Access ISP network identified by the network address and netmask using network interface card eth0:
route add -net 10.13.21.0 netmask 255.255.255.0 gw 192.168.10.254 eth0
Conversly: route del -net 10.13.21.0 netmask 255.255.255.0 gw 192.168.10.254 eth0
Specify default gateway to use to access remote network via network interface card eth0:
route add default gw 201.51.31.1 eth0
(Gateway can also be defined in /etc/sysconfig/network)
Specify two gateways for two network destinations:
(i.e. one external, one internal private network. Two routers/gateways
will be specified.)
Add internet gateway as before: route add default gw 201.51.31.1 eth0
Add second private network: route add -net 10.0.0.0 netmask 255.0.0.0 gw 192.168.10.254 eth0
OpenVPN - SSL VPN
solution for site to site, WiFi security, and enterprise-scale remote
access with load balancing, failover, and fine-grained access-controls.
List externally connected processes: netstat -punta
List all connected processes: netstat -nap
Show network statistics: netstat -s
Kernel interface table info: netstat -a -i eth0
ping - send ICMP ECHO_REQUEST packets to network hosts. Use Cntl-C to stop ping.
traceroute - print the route packets take to network host.
(Ubuntu Note: Typically Ubuntu installs tracepath for IPv4 and traceroute6 for IPv6. One can install traceroute: apt-get install traceroute)
traceroute IP-address-of-server
traceroute domain-name-of-server
mtr
- a network diagnostic tool introduced in Fedora - Like traceroute
except it gives more network quality and network diagnostic info. Leave
running to get real time stats. Reports best and worst round trip times
in milliseconds.
mtr IP-address-of-server
mtr domain-name-of-server
whois - Lookup a domain name in the internic whois database.
finger - Display information on a system user. i.e. finger user@host Uses $HOME/.plan and $HOME/.project user files. Often used by game developers. See http://finger.planetquake.com/
socklist - Display list of open sockets, type, port, process id and the name of the process. Kill with fuser or kill.
host - Give a host name and the command will return IP address. Unlike nslookup, the host command will use both /etc/hosts as well as DNS.
Example: host domain-name-of-server
nslookup - Give a host name and the command will return IP address. Also see
Testing your DNS (YoLinux Tutorial) Note that nslookup does not use the /etc/hosts file.
inetd/xinetd: Network Socket Listener Daemons:
The network listening daemons listen and respond to all network
socket connections made on the TCP/IP ports assigned to it.
The ports are defined by the file /etc/services.
When a connection is made, the listener will attempt to invoke the assigned
program and pipe the data to it.
This simplified matters by allowing the assigned program to read from stdin
instead of making its own sockets connection. The listener hadles the
network socket connection.
Two network listening and management daemons have been used in Red Hat Linux
distributions:
inetd: Red Hat 6.x and older
xinetd: Red Hat 7.0-9.0, Fedora Core
inetd:
Configuration file: /etc/inetd.conf
Entries in this file consist of a single line made up of the following fields:
service socket-type protocol wait user server cmdline
service: The name assigned to the service. Matches the name given in the file /etc/services
socket-type:
stream: connection protocols (TCP)
dgram: datagram protocols (UDP)
raw
rdm
seqpacket
protocol: Transport protocol name which matches a name in the file /etc/protocols. i.e. udp, icmp, tcp, rpc/udp, rpc/tcp, ip, ipv6
wait: Applies only to datagram protocols (UDP).
wait[.max]: One server for the specified port at any time (RPC)
nowait[.max]: Continue to listen and launch new services if a new connection is made. (multi-threaded)
Max refers to the maximum number of server instances spawned in 60 seconds. (default=40)
user[.group]: login id of the user the process is executed under. Often
nobody, root or a special restricted id for that service.
server: Full path name of the server program to be executed.
cmdline: Command line to be passed to the
server. This includes argument 0 (argv[0]), that is the command name.
This field is empty for internal services.
Example of internal TCP services: echo, discard, chargen (character
generator), daytime (human readable time), and time (machine readable
time). (see RFC)
A line may be commented out by using a '#' as the first character in the line.
This will turn the service off.
The maximum length of a line is 1022 characters.
The inet daemon must be restarted to pick up
the changes made to the file:
/etc/rc.d/init.d/inetd restart
For more information see the man pages "inetd" and "inetd.conf".
xinetd: Extended Internet Services Daemon:
Xinetd has access control machanisms, logging capabilities, the ability
to make services available based on time, and can place limits on the
number of servers that can be started, redirect services to different ports
and network interfaces (NIC) or even to a different server, chroot a service etc...
and thus a worthy upgrade
from inetd.
Use the command chkconfig --list to view all system services and their
state.
It will also list all network services controlled by xinetd and their
respective state under the title "xinetd based services".
(Works for xinetd (RH7.0+) but not inetd)
The xinetd network daemon uses PAM also called network wrappers which
invoke the /etc/hosts.allow and /etc/hosts.deny files.
Configuration file: /etc/xinetd.conf which in turn uses configuration files found in the directory /etc/xinetd.d/.
To turn a network service on or off:
Edit the file /etc/xinetd.d/service-name
Set the disable value:
disable = yes
or
disable = no
Restart the xinetd process using the signal:
SIGUSR1 (kill -SIGUSR1 process-id) - Soft reconfiguration does not terminate existing connections. (Important if you are connected remotely)
SIGUSR2 - Hard reconfiguration stops and restarts the xinetd process.
(Note: Using the HUP signal will terminate the process.)
OR
Use the chkconfig command: chkconfig service-name on
(or off)
This command will also restart the xinetd process to pick up the new configuration.
The file contains entries of the form:
service service-name
{
attribute assignment-operator value value ......
{
Where:
attribute:
disable:
yes
no
type:
RPC
INTERNAL:
UNLISTED: Not found in /etc/rpc or /etc/services
id: By default the service id is the same as the service name.
socket_type:
stream: TCP
dgram: UDP
raw: Direct IP access
seqpacket: service that requires reliable sequential datagram transmission
flags: Combination of: REUSE, INTERCEPT, NORETRY, IDONLY, NAMEINARGS, NODELAY, DISABLE, KEEPALIVE, NOLIBWRAP.
See the xinetd man page for details.
protocol: Transport protocol name which matches a name in the file /etc/protocols.
wait:
no: multi-threaded
yes: single-threaded - One server for the specified port at any time (RPC)
user: See file : /etc/passwd
group: See file : /etc/group
server: Program to execute and recieve data stream from socket. (Fully qualified name - full pathe name of program)
server_args: Unlike inetd, arg[0] or the name of the service is not passed.
only_from: IP address, factorized address, netmask range, hostname or network name from file /etc/networks.
no_access: Deny from ... (inverse of only_from)
access_times
port: See file /etc/services
Also: log_type, log_on_success, log_on_failure (Log options: +=
PID,HOST,USERID,EXIT,DURATION,ATTEMPT and RECORD), rpc_version,
rpc_number, env, passenv, redirect, bind, interface, banner,
banner_success, banner_fail, per_source, cps, max_load, groups,
enabled, include, includedir, rlimit_as, rlimit_cpu, rlimit_data,
rlimit_rss, rlimit_stack.
The best source of information is the man page and its many examples.
assignment-operator:
=
+=: add a value to the set of values
-=: delete a value from the set of values
Then restart the daemon: /etc/rc.d/init.d/xinetd restart
Example from man page: Limit telnet sessions to 8 Mbytes of memory and a total 20 CPU seconds for child processes.
service telnet { socket_type = stream wait = no nice = 10 user = root server = /usr/etc/in.telnetd rlimit_as = 8M rlimit_cpu = 20 }
[Pitfall] Red Hat 7.1 with updates as of
07/06/2001 required that I restart the xinetd services before FTP would
work properly even though xinetd had started without failure during the boot
sequence. I have no explanation as to why this occurs or how to fix it other
than to restart xinetd:/etc/rc.d/init.d/xinetd restart.
The "rwho" command is used to display users logged into computers on your LAN.
By default, Red Hat Linux has the network interface to the rwhod disabled.
Thus if one issues the command "rwho",
you will only see who is logged into the system you are logged into and
not remote systems on the network.
This is a safe approach for internet servers as it reduces the exposure
of a service which could be exploited by hackers. If you wish to use rwhod
on a local private and firewall protected network, here is how:
Pluggable Authentication Modules for Linux (TCP Wrappers)
This system allows or denies network access.
One can reject or allow specific IP addresses or subnets to access your system.
File: /etc/hosts.allow
in.ftpd:208.188.34.105
This specifically allows the given IP address to ftp to your system.
One can also specify an entire domain. i.e. .name-of-domain.com
Note the beginning ".".
ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a
The inet daemon accepts the incoming network stream and assigns it
to the PAM TCP wrapper, /usr/sbin/tcpd, which accepts or denies the network connection as
defined by /etc/hosts.allow and /etc/hosts.deny and then
passes it along to ftp. This is logged to /var/log/secure
Advanced PAM: More specific access can be assigned and controlled by
controlling the level of authentication required for access.
Files reflect the inet service name. Rules and modules are stacked to
achieve the level of security desired.
See the files in /etc/pam.d/... (some systems use /etc/pam.conf)
The format: service type control module-path module-arguments
auth - (type) Password is required for the user
nullok - Null or non-existatant password is acceptable
shadow - encrypted passwords kept in /etc/shadow
account - (type) Verifies password. Can track and force password changes.
ICMP is the network protocol used by the ping and traceroute
commands.
ICMP redirect packets are sent from the router to the host to inform the host of a better route.
To enable ICMP redirect, add the following line to /etc/sysctl.conf :
net.ipv4.conf.all.accept_redirects = 1
Add the following to the file: /etc/rc.d/rc.local
for f in /proc/sys/net/ipv4/conf/*/accept_redirects
do
echo 1 > $f
done
Command to view Kernel IP routing cache: /sbin/route -Cn
NOTE: This may leave you vulnerable to hackers as attackers may alter
your routes.
Blocking ICMP and look invisible to ping:
The following firewall rules will drop ICMP requests.
Iptables:
iptables -A OUTPUT -p icmp -d 0/0 -j DROP
Ipchains:
ipchains -A output -p icmp -d 0/0 -j DENY
OR drop all incomming pings:
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
This is sometimes necessary to look invisible to DOS (Denial Of Service)
attackers who use ping to watch your machine and launch an attack when it's
pressence is detected
Network Monitoring Tools:
tcpdump - dump traffic on a network. See discussion below.
Command line option
Description
-c
Exit after receiving count packets.
-C
Specify size of output dump files.
-i
Specify interface if multiple exist. Lowest used by default. i.e. eth0
-w file-name
Write the raw packets to file rather than parsing and printing them out.
They can later be printed with the -r option.
-n
Improve speed by not performing DNS lookups. Report IP addresses.
There is an error in the ethereal package because it does not show the snmp
libraries as a dependancies,
but you can deduce this from the errors that you get if the ucd-snmp
libraries are not installed.
EtherApe -
Graphical network monitor for Unix modeled after etherman. This is a
great network discovery program with cool graphics. (Red Hat Powertools
CD 7.1)
Gkrellm - Network and system monitor. Good for monitoring your workstation. (Red Hat Powertools CD)
IPTraf - ncurses-based IP LAN monitor. (Red Hat Powertools CD)
Cheops - Network
discovery, location, diagnosis and management. Cheops can identify all
of the computers that are on your network, their IP address, their DNS
name, the operating system they are running. Cheops can run a port scan
on any system on your network. (Red Hat Powertools CD)
ntop - Shows network usage in a way similar to what top does for processes.
Monitors how much data is being sent and received on your network. (Red Hat Powertools CD)
MRTG -
Multi Router Traffic Grapher - Monitor network traffic load using SNMP
and generate an HTML/GIF report.
(See sample output)
dnsad - IP traffic capture. Export to Cisco Netflow for network analysis reporting.
scotty
- Obtain status and configuration information about your network.
Supports SNMP, ICMP, DNS, HTTP, SUN RPC, NTP, & UDP. (Red Hat
Powertools CD)
Big Brother - Monitoring ans services availablility.
[root]# ifconfig eth0 promisc - Put nic into promiscuous mode to sniff traffic.[root]# tcpdump -n host not XXX.XXX.XXX.XXX | more - Sniff net but ignore IP which is your remote session.[root]# ifconfig eth0 -promisc - Pull nic out of promiscuous mode.
Network Intrusion and Hacker Detection Systems:
SNORT: Monitor the network, performing real-time traffic analysis and
packet logging on IP networks for the detection of an attack or probe.
Ethernet hosts use the Address Resolution Protocol (ARP) to
convert a 32-bit internet IP addresses into a 48-bit Ethernet MAC
address used by network hardware. (See: RFC 826) ARP broadcasts are sent to all hosts on the subnet by the data transmitting host to see who replies.
The broadcast is ignored by all except the intended receiver which recognizes the IP address as its own. The MAC addresses are remembered (APR cache) for future network communications.
Computers on the subnet typically keep a cache of ARP responses.
ARP broadcasts are passed on by hubs and switches but are blocked by routers.
Reverse ARP (See: RFC 903) is a bootstrap protocol which allows a client to broadcast requesting a server to reply with its IP address.
arping (8) man page - send ARP REQUEST to a neighbor host
Print ARP reply (similar to arp -a): arping 192.168.10.99
List ARP table: cat /proc/net/arp
ip (8) man page - show / manipulate routing, devices, policy routing and tunnels
View ARP table: ip neighbor
ARP is something that simply works. No Linux system configuration is necessary.
It's all part of the ethernet and IP protocol.
The aforementioned information is just part of the Linux culture of full visibility into what is going on.
Configuring Linux For Network Multicast:
Regular network exchanges of data are peer to peer unicast transactions.
An HTTP request to a web server (TCP/IP), email SNMP (TCP/IP), DNS (UDP),
FTP (TCP/IP), ... are all peer to peer unicast transactions.
If one wants to transmit a video, audio or data stream to multiple nodes with
one transmission stream instead of multiple individual peer to peer connections,
one for each node, one may use multicasting to reduce network load.
Note that multicast and a network broadcast are different.
Multicast messages are only "heard" by the nodes on the network that have
"joined the multicast group" which are those that are interested in the
information.
The Linux kernel is Level-2 Multicast-Compliant.
It meets all requirements to send, receive and act as a router for multicast datagrams.
For a process to receive multicast datagrams it has to request the kernel to
join the multicast group and bind the port receiving the datagrams.
When a process is no longer interested in the multicast group, a request is made to the kernel to leave the group.
It is the kernel/host which joins the multicast group and not the process.
Kernel configuration requires "CONFIG_IP_MULTICAST=y".
In order for the Linux kernel to support multicast routing, set
the following in the kernel config:
CONFIG_IP_MULTICAST=y
CONFIG_IP_ROUTER=y
CONFIG_IP_MROUTE=y
CONFIG_NET_IPIP=y
The default Red Hat / Fedora kernels are compiled to support multicast.
Note that on multihomed systems (more than one IP address/network card),
only one device can be configured to handle multicast.
Class D networks with a range of IP addresses from 224.0.0.0 to 239.255.255.255
(See Network Classes above) have typically been reserved for multicast.
Usefull commands:
Command
Description
cat /proc/net/igmp
List multicast group to which the host is subscribed. Use "Internet Group Management Protocol".
(See /usr/src/linux/net/core/igmp.c)
cat /proc/net/dev_mcast
List multicast interfaces.
(See /usr/src/linux/net/core/dev_mcast.c)
ping 224.0.0.1
All hosts configured for multicast will respond with their IP addresses
ping 224.0.0.2
All routers configured for multicast will respond
ping 224.0.0.3
All PIM routers configured for multicast will respond
ping 224.0.0.4
All DVMRP routers configured for multicast will respond
ping 224.0.0.5
All OSPF routers configured for multicast will respond
Multicast transmissions are achieved through proper routing,
router configuration (if communicating through subnets) and
programatically with the use of the following "C" function library
calls:
The multicast application will specify the multicast
loopback interface, TTL (network time to live), network interface and
the multicast group to add or drop.
Add route to support multicast:
route add 224.0.0.0 netmask 240.0.0.0 dev eth0
Note that if adding a route to forward packets through a router, that
the router MUST be configured to forward multicast packets. Many
routers do not support forwarding of multicast packets or have a
default configuration which does not.
The internet by default does not forward multicast packets.
In Nautilus use the URL "smb:" to view MS/Windows servers. [tutorial]
LinNeighborhood: Linux workstation gui tool.
Make your life simple and use the GUI/File Manager LinNeighborhood.
It uses smbmount, samba and smbclient to give you access to MS/Windows servers
and printers.
IPv4: Most of the Internet servers and personal
computers use Internet Protocol version 4 (IPv4). This uses 32 bits to
assign a network address as defined by the four octets of an IP address
up to 255.255.255.255. Which is the representation of four 8 bit
numbers thus totaling 32 bits.
IPv6: Internet Protocol version 6 (IPv6) uses a 128
bit address and thus billions and billions of potential addresses. The
protocol has also been upgraded
to include new quality of service features and security. Currently
Linux supports IPv6 but IPv4 is used when connecting your computer to
the internet.
TCP/IP: (Transmission Control Protocol/Internet
Protocol) uses a client - server model for communications. The protocol
defines the data packets transmitted
(packet header, data section), data integrity verification (error
detection bytes), connection and acknowledgement protocol, and
re-transmission.
TCP/IP time to live (TTL): This is a counting
mechanism to determine how long a packet is valid before it reaches its
destination. Each time a TCP/IP packet passes through a router it will
decrement its TTL count. When the count reaches zero the packet is
dropped by the router. This ensures that errant routing and looping
aimless packets will not flood the network.
MAC Address: (media access control) is the network
card address used for communication between other network devices on
the subnet. This info is not routable. The ARP table maps TCP/IP
address (global internet) to the local hardware on the local network.
Use the command /sbin/ifconfig to view both the IP address
and the MAC address. The MAC address uniquely identifies each node of a
network and is used by the Ethernet protocol.
Full Duplex: Allows the simultaneous sending and receiving of packets.
Most modern modems support full duplex.
Half Duplex: Allows the sending and receiving of packets in one direction at a time only.
OSI 7 Layer Model: The ISO (International Standards
Organization) has defined the OSI (Open Systems Interconnection) model
for current networking protocols.
OSI Layer
Description
Linux Networking Use
7
Application Layer.
The top layer for communications applications like email and the web.
telnet, web browser, sendmail
6
Presentation Layer.
Syntax and format of data transfer.
SMTP, http
5
Session Layer.
4
Transport Layer.
Connection, acknowledgement and data packet transmission.
TCP
UDP
3
Network Layer.
IP
ARP
2
Data Link Layer.
Error control, timing
Ethernet
1
Physical Layer.
Electrical characteristics of signal and NIC
Ethernet
Network Hub: Hardware to connect network devices
together. The devices will all be on the same network and/or subnet.
All network traffic is shared and can be sniffed by any other node
connected to the same hub.
Network Switch: Like a hub but creates a private
link between any two connected nodes when a network connection is
established. This reduces the amount of network collisions and thus
improves speed. Broadcast messages are still sent to all nodes.
"Networking Linux: A Practical Guide to TCP/IP"
by Pat Eyler
ISBN # 0735710317, New Riders Publishing
"LINUX TCP/IP Network Administration
by Scott Mann, Mitchell Krell
ISBN # 0130322202, rentice Hall PTR
"Advanced Linux Networking"
by Roderick W. Smith
ISBN# 0201774232, Addison-Wesley Professional; 1st edition (July 15, 2002)
"Linux Routing"
by Dee Ann LeBlanc, Joe "Zonker" Brockmeier, Ronald W. McCarty Jr.
ISBN# 1578702674, Sams; 1st edition (October 11, 2001)
"Policy Routing Using Linux"
by Matthew G. Marsh
ISBN# 0672320525, Sams; (March 6, 2001)
"Practical Guide to Ubuntu Linux (Versions 8.10 and 8.04)"
by Mark Sobell
Prentice Hall PTR, ISBN# 0137003889
2 edition (January 9, 2009)
"Fedora 10 and Red Hat Enterprise Linux Bible"
by Christopher Negus
Wiley, ISBN# 0470413395
"Red Hat Fedora 6 and Enterprise Linux Bible"
by Christopher Negus
Sams, ISBN# 047008278X
"Fedora 7 & Red Hat Enterprise Linux: The Complete Reference"
by Richard Petersen
Sams, ISBN# 0071486429
"Red Hat Fedora Core 6 Unleashed"
by Paul Hudson, Andrew Hudson
Sams, ISBN# 0672329298
"Red Hat Linux Fedora 3 Unleashed"
by Bill Ball, Hoyt Duff
Sams, ISBN# 0672327082
"Red Hat Linux 9 Unleashed"
by Bill Ball, Hoyt Duff
Sams, ISBN# 0672325888
I have the Red Hat 6 version and I have found it to be very helpful.
I have found it to be way more complete than the other Linux books.
It is the most complete general Linux book in publication. While other
books in the "Unleashed" series have dissapointed me, this book
is the best out there.
"Redhat Linux 9 (Visual QuickPro Guide)"
by Harold Davis
ISBN #032121918X, Peachpit Press, Addison Wesley
The best basic Linux book around for the GUI generation.
This book can be best described as a guide to using the GUI
configuration tools.
Books:
