Chapter 8: Network Management

Foreword

We recommend that you do not use AI to do the exercises, as you are still in the learning phase.

Introduction

In this section, we will cover the following topics:



Computer networks (briefly)

Introduction to computer networks

A computer network is a group of computers and devices connected to each other to share resources, exchange data, and provide services. Computer networks are essential in the modern world, enabling communication, file sharing, and access to remote resources.

How does it all work?

In order for computers to communicate with each other, they must speak a common language: these are network protocols. The most fundamental of all is TCP/IP.

The TCP/IP model (how the Internet really works)

TCP/IP is the set of rules (or “protocol stack”) used to operate the Internet and most networks. It is composed of several layers, each with a specific role.

Layers of the TCP/IP model (simplified):

| Layer | Role | | ——————- | ————————————————————————— | | 1. Network access | Manages communication with hardware (Wi-Fi, Ethernet cable, etc.) | | 2. Internet | Allows you to find the IP address of a computer on the network (IP protocol) | | 3. Transport | Ensures reliable or fast communication (TCP or UDP) | | 4. Application | What the user uses: HTTP, FTP, email, etc. |

TCP and UDP: two ways to transport data

At the Transport layer, two protocols are mainly used:

TCP (Transmission Control Protocol)

UDP (User Datagram Protocol)

OSI vs TCP/IP — What’s the difference?

| OSI (7 layers) | TCP/IP (4 layers) | | ————————- | ———————————————————————- | | Theoretical model | Real model, used on the Internet | | More detailed | More practical and implemented | | Clearly separates functions | Merges certain layers (e.g., application + presentation + session) |

In practice, networks use TCP/IP, but OSI helps to understand what happens at each stage.

Types of Computer Networks

You should know that there are different types of networks:

Below is an example of the output.

$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00: 00:00:00
    inet 127.0.0.1/8 scope host lo
    valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute
        
valid_lft forever preferred_lft forever
2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 52:54:00:c8:9a:ac brd ff:ff:ff:ff:ff:ff
    
inet 172.30.1.2/24 brd 172.30.1.255 scope global dynamic noprefixroute enp1s0
       valid_lft 86302846sec preferred_lft 75513646sec
    inet6 fe80::7008:be3c: 4abc:6bcd/64 scope link 
       valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1454 qdisc noqueue state DOWN group default 
    link/ether 02:42:4c:21:02:63 brd ff:ff:ff:ff:ff:ff
    
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever

In our case, we have three network interfaces: lo, enp1s0, and docker0. | Interface | Type | IPv4 Address | IPv6 Address | MAC Address | Status | | ——— | ——— | ————- | ————————- | —————– | —————– | | lo | Loopback | 127.0.0.1/8 | ::1/128 | 00:00:00:00:00:00 | UP | | enp1s0 | Ethernet | 172.30.1.2/24 | fe80::… /64 (link-local) | 52:54:00:c8:9a:ac | UP | | docker0 | Virtual | 172.17.0.1/16 | (no IPv6 here) | 02:42:4c:21:02:63 | DOWN (no carrier) |

Focus on the loopback interface

The loopback interface (lo) allows a machine to send messages to itself, as if it were going through the network. This may seem unnecessary, but in reality, it is fundamental for:

# 1. Local network testing (localhost)

2. Internal system services

3. Network diagnostics

4. Security

Concrete example:

Let’s imagine that you are developing a local web application:

python3 -m http.server 8000

You can access it from your browser via:

http://127.0.0.1:8000

Even if you have no Internet access, this communication works via the loopback interface.

In summary:

The lo interface allows a computer to address itself via standard network protocols. This is essential for:

Network configuration and routing in Linux

Understanding routing

In networking, “routing” means deciding which path (interface, gateway) to send IP packets along to reach a destination. Let’s look at some commands related to routing.

route (old command)

The route command is obsolete, but still used sometimes to display the routing table:

route -n

This shows the paths used to reach known networks. The -n avoids DNS resolution for faster display.

ip r or ip route (modern)

ip route
# or shorter:
ip r

Displays the system’s current routing table.

Example:
default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100

ip route get

ip route get 8.8.8.8

Displays the exact path that a packet would take to reach a given IP.

Example result:
8.8.8.8 via 192.168.1.1 dev eth0 src 192.168.1.100

Configuring a network interface

Method 1 – Temporary (non-persistent)

Using ip commands:

# Assign an IP address to the eth0 interface
sudo ip addr add 192.168.1.100/24 dev eth0
# Enable the interface
sudo ip link set eth0 up
# Add a gateway
sudo ip route add default via 192.168.1.1

⛔ This configuration is temporary: it disappears after a reboot or deactivation of the interface.

Method 2 – Persistent (configuration retained after reboot)

Depends on the distribution:

Debian / Ubuntu (with Netplan or interfaces)

With netplan (Ubuntu 18.04+)

Edit the YAML file:

sudo nano /etc/netplan/01-netcfg.yaml

Example of static configuration:

network:
  version: 2
  ethernets:
    eth0:
      dhcp4: no
      addresses: [192.168.1.100/24]
      gateway4: 192.168.1.1
      nameservers:
        addresses: [8.8.8.8, 1.1.1.1]

Then apply:

sudo netplan apply
With /etc/network/interfaces (older systems):
auto eth0
iface eth0 inet static
  
address 192.168.1.100
  netmask 255.255.255.0
  gateway 192.168.1.1
  dns-nameservers 8.8.8.8

Restart the network:

sudo systemctl restart networking

Red Hat / CentOS / Fedora (with nmcli or ifcfg- files)

Sample file:

/etc/sysconfig/network-scripts/ifcfg-eth0

Contents:

DEVICE=eth0
BOOTPROTO=static
ONBOOT=yes
IPADDR=192.168.1.100
NETMASK=255.255.255.0
GATEWAY=192.168.1.1
DNS1=8.8.8.8

Restarting the interface:

sudo ifdown eth0 && sudo ifup eth0

Summary

| Command / Element | Role | | —————————– | ———————————————- | | ip r / ip route | Displays the routing table | | ip route get <IP> | Shows the network path used | | route -n | Old method for viewing the routing table | | gateway | Gateway to the outside (router) | | ip addr add / ip link | Temporary interface configuration | | YAML or interfaces files | Persistent configuration |

DNS

DNS (Domain Name System) is a system that translates domain names into IP addresses. It is essential for browsing the Internet! You can change your DNS in different ways. Either via the /etc/resovl.conf file. Or via the Network Manager graphical interface.


⚠️ Warning: In some modern distributions (Ubuntu, Fedora, etc.), this file is generated automatically by services such as systemd-resolved or NetworkManager. Therefore, any manual changes to /etc/resolv.conf may be overwritten upon reboot.


Now let’s talk about the /etc/hosts file! Before even consulting a DNS server, Linux first checks the /etc/hosts file. This file allows you to manually associate host names with IP addresses. It is used as a priority, before DNS, for local resolution.

Example of a /etc/hosts file:

127.0.0.1       localhost
127.0.1.1       mypc.local mypc
192.168.1.100   web-server.local mysite

Explanation:

Role of Network Ports and Services

Ports are numbers that identify the services listening on a machine. You can see the standard port numbers and services in the /etc/services file.

… ftp-data 20/tcp ftp 21/tcp fsp 21/udp fspd ssh 22/tcp # SSH Remote Login Protocol telnet 23/tcp smtp 25/tcp mail


# Some network troubleshooting tools in Linux

**INFO:** <br>
The tools listed below are included in the “net-tools” package. You will need to install it if you don't already have it.🙂

## Ping
- **What is Ping?**: Ping tests connectivity and measures response time.
- **How to use Ping**:
 
```bash
 # Test connectivity with Google
 ping google.com

Traceroute

Capture traffic on the eth0 interface

sudo tcpdump -i eth0

## Wireshark
- **What is Wireshark?**: Wireshark analyzes network traffic.
- **How to use Wireshark**:
 ```bash
 # Launch Wireshark
 sudo wireshark

Nmap



Training ⚔️

EXERCISE 1

Complete challenges 0 to 20 in the “Bandit” category on the ‘overthewire’ platform. Link: https://overthewire.org/wargames/bandit/ (This link goes directly to the “Bandit” category) The first challenges will serve as a review 🙂.

EXERCISE 2

You must perform a complete network analysis on the public server scanme.nmap.org using the Nmap tool to answer the following questions:

  1. What is the version of the SSH service (port 22) hosted on this server?
  2. What service is available on port 80/tcp ?
  3. How many TCP ports are in the open state ?
  4. Which service is associated with port 9929/tcp ? ⚠️ Warning: It is illegal to scan a network or website that does not belong to you without permission. “scanme.nmap.org” is a testing platform provided by nmap to test the nmap tool freely.

EXERCISE 3

Challenge script link: https://raw.githubusercontent.com/N0vachr0n0/NoFD/refs/heads/main/Network_EXO_1.sh

Feedback

Please give us your feedback about this chapter.

👉🏾 Click here