YoLinux Tutorial - Linux Networking
This tutorial covers TCP/IP networking and system configuration basics. Linux can support multiple network devices. The device names are numbered and begin at zero and count upwards. For example, a computer running two ethernet cards will have two devices labeled /dev/eth0 and /dev/eth1.

Contents:

Also see: Subnet guide

Configuration files:

Network GUI Configuration Tools:

YoLinux Networking Tutorials:

Assigning an IP address:

Computers may be assiged a static IP address or assigned one dynamically.

Static IP address assignment:

Choose one of the following methods:

The ifconfig command does NOT store this information permanently. Upon reboot this information is lost. (Manually add the commands to the end of the file /etc/rc.d/rc.local to execute them upon boot.) The commands netcfg and netconfig make permanent changes to system network configuration files located in /etc/sysconfig/network-scripts/, so that this information is retained.

The IANA has allocated IP addresses in the range of 192.168.0.0 to 192.168.255.255 for private networks.

Helpful tools:

The Red Hat configuration tools store the configuration information in the file /etc/sysconfig/network. They will also allow one to configure routing information.

In order for updated information in any of these files to take effect, one must issue the command: service network restart

Changing the host name:

This is a three step process:

  1. Issue the command: hostname new-host-name
  2. Change network configuration file: /etc/sysconfig/network
    Edit entry: HOSTNAME=new-host-name
  3. Restart systems which relied on the hostname (or reboot):
One may also want to check the file /etc/hosts for an entry using the system name which allows the system to be self aware.

DHCP:

Dynamic Host Configuration Protocol (DHCP) automatically assigns IP addresses to computers on a network. A client configured for DHCP will send out a broadcast to the DHCP server requesting an address. The DHCP server will then issue a "lease" and assign it to that client. The time period of a valid lease can be specified on the server. DHCP reduces the ammount of time required to configure clients and allows one to move a computer to various networks and be configured with the appropriate IP address, gateway and subnet mask. For ISP's it conserves the limited number of IP addresses it may use. DHCP servers may assign a "static" IP address to specified hardware. Microsoft NetBios information is often included in the network information sent by the DHCP server.

DHCP assignment:

  1. Lease Request: Client broadcasts request to DHCP server with a source address of 0.0.0.0 and a destination address of 255.255.255.255. The request includes the MAC address which is used to direct the reply.
  2. IP lease offer: DHCP server replies with an IP address, subnet mask, network gateway, name of the domain, name servers, duration of the lease and the IP address of the DHCP server.
  3. Lease Selection: Client recieves offer and broadcasts to al DHCP servers that will accept given offer so that other DHCP server need not make an offer.
  4. The DHCP server then sends an ack to the client. The client is configured to use TCP/IP.
  5. Lease Renewal: When half of the lease time has expired, the client will issue a new request to the DHCP server.

For more on DHCP see the man pages:

DHCP RFC's: RFC2131, RFC1541 (obsolete), RFC2132

Note: DHCP client will overwrite your /etc/resolv.conf file with new information recieved from the DHCP server.

Get connection info: /sbin/pump -i eth0 --status 

Device eth0
	IP: 4.XXX.XXX.XXX
	Netmask: 255.255.252.0
	Broadcast: 4.XXX.XXX.255
	Network: 4.XXX.XXX.0
	Boot server 131.XXX.XXX.4
	Next server 0.0.0.0
	Gateway: 4.XXX.XXX.1
	Domain: vz.dsl.genuity.net
	Nameservers: 4.XXX.XXX.1 4.XXX.XXX.2 4.XXX.XXX.3
	Renewal time: Sat Aug 11 08:28:55 2001
	Expiration time: Sat Aug 11 11:28:55 2001

Network aliasing:

Assign more than one IP address to one ethernet card: 
    ifconfig eth0   XXX.XXX.XXX.XXX netmask 255.255.255.0 broadcast XXX.XXX.XXX.255
    ifconfig eth0:0 192.168.10.12   netmask 255.255.255.0 broadcast 192.168.10.255
    ifconfig eth0:1 192.168.10.14   netmask 255.255.255.0 broadcast 192.168.10.255
 
    route add -host XXX.XXX.XXX.XXX dev eth0
    route add -host 192.168.10.12 dev eth0
    route add -host 192.168.10.14 dev eth0
In this example 0 and 1 are aliases in addition to the regular eth0. The result of the ifconfig command: 
eth0      Link encap:Ethernet  HWaddr 00:10:4C:25:7A:3F  
          inet addr:XXX.XXX.XXX.XXX  Bcast:XXX.XXX.XXX.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:14218 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1362 errors:0 dropped:0 overruns:0 carrier:0
          collisions:1 txqueuelen:100 
          Interrupt:5 Base address:0xe400 

eth0:0    Link encap:Ethernet  HWaddr 00:10:4C:25:7A:3F  
          inet addr:192.168.10.12  Bcast:192.168.10.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:5 Base address:0xe400 

eth0:1    Link encap:Ethernet  HWaddr 00:10:4C:25:7A:3F  
          inet addr:192.168.10.14  Bcast:192.168.10.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:5 Base address:0xe400

The option during kernel compile is: CONFIG_IP_ALIAS=y (Enabled by default in Redhat)

Starting and stopping the interface: 

  ifconfig eth0 down
  ifconfig eth0 up        - No IP address assigned but you can listen.

Starting and stopping TCP/IP network services on an interface: 

  ifdown eth0
  ifup   eth0

Subnets:

MASK # OF SUBNETS CLASS A
HOSTS		 CLASS A
MASK		 CLASS B
HOSTS		 CLASS B
MASK		 CLASS C
HOSTS		 CLASS C
MASK		 CLASS C SUB
HOSTS		 CLASS C SUB
MASK
255 1 or 256 16,777,214 255.0.0.0 65,534 255.255.0.0 254 255.255.255.0 1 - Invalid 255.255.255.255
254 128 33,554,430 254.0.0.0 131,070 255.254.0.0 510 255.255.254.0 0 - Invalid 255.255.255.254
252 64 67,108,862 252.0.0.0 262,142 255.252.0.0 1,022 255.255.252.0 2 255.255.255.252
248 32 134,217,726 248.0.0.0 524,286 255.248.0.0 2,046 255.255.248.0 6 255.255.255.248
240 16 268,435,454 240.0.0.0 1,048,574 255.240.0.0 4,094 255.255.240.0 14 255.255.255.240
224 8 536,870,910 224.0.0.0 2,097,150 255.224.0.0 8,190 255.255.224.0 30 255.255.255.224
192 4 1,073,741,822 192.0.0.0 4,194,302 255.192.0.0 16,382 255.255.192.0 62 255.255.255.192
128 2 2,147,483,646 128.0.0.0 8,388,606 255.128.0.0 32,766 255.255.128.0 126 255.255.255.128

Binary position 8 7 6 5 4 3 2 1
Value 128 64 32 16 8 4 2 1
Example: 192 1 1 0 0 0 0 0 0

Example 192=128+64

Some addresses are reserved and outside this scope. Loopback (127.0.0.1), reserved class C 192.168.XXX.XXX, reserved class B 172.31.XXX.XXX and reserved class A 10.XXX.XXX.XXX.

Links:

Network Classes:

The concept of network classes is a little obsolete as subnets are now used to define smaller networks. These subnets may be part of a class A, B, C, etc network. For historical reference the network classes are defined as follows:

Enable Forwarding:

All methods will result in a proc file value of "1". Test: cat /proc/sys/net/ipv4/ip_forward

The TCP Man page - Linux Programmer's Manual and /usr/src/linux/Documentation/proc.txt (Kernel 2.2 RH 7.0-) [alt link] cover /proc/sys/net/ipv4/* file descriptions.

To set up an internet gateway router using Linux, see the YoLinux tutorial Using Linux and iptables/ipchains to set up an internet gateway for home or office.

Adding a network interface card (NIC):

Manual method: This does not alter the permanent configuration and will only configure support until the next reboot.

The easy way: Red Hat versions 6.2 and later, ship with Kudzu, a device detection program which runs during system initialization. (/etc/rc.d/init.d/kudzu) This can detect a newly installed NIC and load the appropriate driver. Then use /usr/sbin/netconfig to configure the IP address and network settings. The configuration will be stored so that it will be utilized upon system boot.

Systems with two NIC cards: Typically two cards are used when connecting to two networks. In this case the device must be defined using one of three methods:

  1. Use the GUI tool /usr/bin/netcfg

    OR

  2. Define network parameters in configuration files:

    Define new device in file /etc/sysconfig/network-scripts/ifcfg-eth1 

        DEVICE=eth1
    BOOTPROTO=static
    IPADDR=192.168.10.12
    NETMASK=255.255.255.0
    GATEWAY=XXX.XXX.XXX.XXX
    HOSTNAME=node-name.name-of-domain.com
    DOMAIN=name-of-domain.com
    Special routing information may be specified, if necessary, in the file: /etc/sysconfig/static-routes
    Example: 
    eth1 net XXX.XXX.XXX.0 netmask 255.255.255.0 gw XXX.XXX.XXX.XXX

    OR

  3. Define network parameters using Unix command line interface:

    Define IP address: 

        ifconfig eth0  XXX.XXX.XXX.XXX netmask 255.255.255.0 broadcast XXX.XXX.XXX.255
    ifconfig eth1  192.168.10.12   netmask 255.255.255.0 broadcast 192.168.10.255

    If necessary, define route with with the route command:
    Examples: 

      route add default gw XXX.XXX.XXX.XXX dev eth0
  route add  -net  XXX.XXX.XXX.0  netmask 255.255.255.0 gw XXX.XXX.XXX.XXX dev eth0
    Where XXX.XXX.XXX.XXX is the gateway to the internet as defined by your ISP or network operator.

    If a mistake is made just repeat the route command substituting "del" in place of "add".

Route:

Static routes: IP (Internet Protocol) uses a routing table to determine where packets should be sent. First the packet is examined to see if its' destination is for the local or remote network. If it is to be sent to a remote network, the routing table is consulted to determine the path. If there is no information in the routing table then the packet is sent to the default gateway. Static routes are set with the route command and with the configuration file /etc/sysconfig/static-routes.

Dynamic routes: RIP (Routing Information Protocol) is used to define dynamic routes. If multiple routes are possible, RIP will choose the shortest route. (Fewest hops between routers not physical distance.) Routers use RIP to broadcast the routing table over UDP port 520. The routers would then add new or improved routes to their routing tables.

Man pages:

VPN, Tunneling:

Usefull Linux networking commands:

inetd/xinetd: Network Socket Listener Daemons:

The network listening daemons listen and respond to all network socket connections made on the TCP/IP ports assigned to it. The ports are defined by the file /etc/services. When a connection is made, the listener will attempt to invoke the assigned program and pipe the data to it. This simplified matters by allowing the assigned program to read from stdin instead of making its own sockets connection. The listener hadles the network socket connection. Two network listening and management daemons have been used in Red Hat Linux distributions:

inetd:

Configuration file: /etc/inetd.conf
Entries in this file consist of a single line made up of the following fields: 
        service socket-type protocol wait user server cmdline

  • service: The name assigned to the service. Matches the name given in the file /etc/services
  • socket-type:
    • stream: connection protocols (TCP)
    • dgram: datagram protocols (UDP)
    • raw
    • rdm
    • seqpacket
  • protocol: Transport protocol name which matches a name in the file /etc/protocols. i.e. udp, icmp, tcp, rpc/udp, rpc/tcp, ip, ipv6
  • wait: Applies only to datagram protocols (UDP).
    • wait[.max]: One server for the specified port at any time (RPC)
    • nowait[.max]: Continue to listen and launch new services if a new connection is made. (multi-threaded)
    Max refers to the maximum number of server instances spawned in 60 seconds. (default=40)
  • user[.group]: login id of the user the process is executed under. Often nobody, root or a special restricted id for that service.
  • server: Full path name of the server program to be executed. cmdline: Command line to be passed to the server. This includes argument 0 (argv[0]), that is the command name. This field is empty for internal services. Example of internal TCP services: echo, discard, chargen (character generator), daytime (human readable time), and time (machine readable time). (see RFC)

Sample File: /etc/inetd.conf 

#echo   stream  tcp     nowait  root    internal
#echo   dgram   udp     wait    root    internal

ftp     stream  tcp     nowait  root    /usr/sbin/tcpd  in.ftpd -l -a
#pop-3   stream  tcp     nowait  root    /usr/sbin/tcpd ipop3d
#swat      stream  tcp     nowait.400      root /usr/sbin/swat swat
A line may be commented out by using a '#' as the first character in the line. This will turn the service off. The maximum length of a line is 1022 characters.

The inet daemon must be restarted to pick up the changes made to the file:
/etc/rc.d/init.d/inetd restart

For more information see the man pages "inetd" and "inetd.conf".

xinetd: Extended Internet Services Daemon

Xinetd has access control machanisms, logging capabilities, the ability to make services available based on time, and can place limits on the number of servers that can be started, redirect services to different ports and network interfaces (NIC) or even to a different server, chroot a service etc... and thus a worthy upgrade from inetd.

Use the command chkconfig --list to view all system services and their state. It will also list all network services controlled by xinetd and their respective state under the title "xinetd based services". (Works for xinetd (RH7.0+) but not inetd)

The xinetd network daemon uses PAM also called network wrappers which invoke the /etc/hosts.allow and /etc/hosts.deny files.

Configuration file: /etc/xinetd.conf which in turn uses configuration files found in the directory /etc/xinetd.d/.

To turn a network service on or off:

  • Edit the file /etc/xinetd.d/service-name
    Set the disable value:
    disable = yes
    or
    disable = no
    Restart the xinetd process using the signal:
    • SIGUSR1 (kill -SIGUSR1 process-id) - Soft reconfiguration does not terminate existing connections. (Important if you are connected remotely)
    • SIGUSR2 - Hard reconfiguration stops and restarts the xinetd process.
    (Note: Using the HUP signal will terminate the process.)
    OR
  • Use the chkconfig command: chkconfig service-name on
    (or off)
    This command will also restart the xinetd process to pick up the new configuration.

The file contains entries of the form: 

      service service-name
      {
         attribute  assignment-operator value value ...
         ...
      {
Where:
  • attribute:
    • disable:
      • yes
      • no
    • type:
      • RPC
      • INTERNAL:
      • UNLISTED: Not found in /etc/rpc or /etc/services
    • id: By default the service id is the same as the service name.
    • socket_type:
      • stream: TCP
      • dgram: UDP
      • raw: Direct IP access
      • seqpacket: service that requires reliable sequential datagram transmission
    • flags: Combination of: REUSE, INTERCEPT, NORETRY, IDONLY, NAMEINARGS, NODELAY, DISABLE, KEEPALIVE, NOLIBWRAP. See the xinetd man page for details.
    • protocol: Transport protocol name which matches a name in the file /etc/protocols.
    • wait:
      • no: multi-threaded
      • yes: single-threaded - One server for the specified port at any time (RPC)
    • user: See file : /etc/passwd
    • group: See file : /etc/group
    • server: Program to execute and recieve data stream from socket. (Fully qualified name - full pathe name of program)
    • server_args: Unlike inetd, arg[0] or the name of the service is not passed.
    • only_from: IP address, factorized address, netmask range, hostname or network name from file /etc/networks.
    • no_access: Deny from ... (inverse of only_from)
    • access_times
    • port: See file /etc/services
    Also: log_type, log_on_success, log_on_failure (Log options: += PID,HOST,USERID,EXIT,DURATION,ATTEMPT and RECORD), rpc_version, rpc_number, env, passenv, redirect, bind, interface, banner, banner_success, banner_fail, per_source, cps, max_load, groups, enabled, include, includedir, rlimit_as, rlimit_cpu, rlimit_data, rlimit_rss, rlimit_stack.
    The best source of information is the man page and its many examples.
  • assignment-operator:
    • =
    • +=: add a value to the set of values
    • -=: delete a value from the set of values

Then restart the daemon: /etc/rc.d/init.d/xinetd restart

Example from man page: Limit telnet sessions to 8 Mbytes of memory and a total 20 CPU seconds for child processes. 

              service telnet
              {
                     socket_type         = stream
                     wait                = no
                     nice                = 10
                     user                = root
                     server              = /usr/etc/in.telnetd
                     rlimit_as           = 8M
                     rlimit_cpu          = 20
              }

[Pitfall] Red Hat 7.1 with updates as of 07/06/2001 required that I restart the xinetd services before FTP would work properly even though xinetd had started without failure during the boot sequence. I have no explanation as to why this occurs or how to fix it other than to restart xinetd: /etc/rc.d/init.d/xinetd restart.

Man Pages:

For more info see:

RPC: Remote Procedure Calls (Portmapper)

Portmpper is a network service required to support RPC's. Many services such as NFS (file sharing services) require portmapper.

List RPC services supported: [root]# rpcinfo -p localhost

Starting portmap server:

Man Pages:

PAM: Network Wrappers:

Pluggable Authentication Modules for Linux (TCP Wrappers)

This system allows or denies network access. One can reject or allow specific IP addresses or subnets to access your system.

File: /etc/hosts.allow 

   in.ftpd:208.188.34.105
This specifically allows the given IP address to ftp to your system. One can also specify an entire domain. i.e. .name-of-domain.com
Note the beginning ".".

File: /etc/hosts.deny 

   ALL:ALL
This generally denies any access.

See the pam man page.

File: /etc/inetd.conf 

   ftp     stream  tcp     nowait  root    /usr/sbin/tcpd  in.ftpd -l -a

The inet daemon accepts the incoming network stream and assigns it to the PAM TCP wrapper, /usr/sbin/tcpd, which accepts or denies the network connection as defined by /etc/hosts.allow and /etc/hosts.deny and then passes it along to ftp. This is logged to /var/log/secure

Advanced PAM: More specific access can be assigned and controlled by controlling the level of authentication required for access.

Files reflect the inet service name. Rules and modules are stacked to achieve the level of security desired.

See the files in /etc/pam.d/... (some systems use /etc/pam.conf)

The format: service type control module-path module-arguments

Modules:

After re-configuration, restart the inet daemon: killall -HUP inetd

For more info see:

ICMP:

ICMP is the network protocol used by the ping and traceroute commands.

ICMP redirect packets are sent from the router to the host to inform the host of a better route. To enable ICMP redirect, add the following line to /etc/sysctl.conf : 

net.ipv4.conf.all.accept_redirects = 1

Add the following to the file: /etc/rc.d/rc.local 

for f in /proc/sys/net/ipv4/conf/*/accept_redirects
do
   echo 1 > $f 
done

Command to view Kernel IP routing cache: /sbin/route -Cn

NOTE: This may leave you vulnerable to hackers as attackers may alter your routes.

Blocking ICMP and look invisible to ping:

The following firewall rules will drop ICMP requests.
Iptables: 
iptables -A OUTPUT -p icmp -d 0/0 -j DROP
Ipchains: 
ipchains -A output -p icmp -d 0/0 -j DENY
This is sometimes necessary to look invisible to DOS (Denial Of Service) attackers who use ping to watch your machine and launch an attack when it's pressence is detected

Network Monitoring Tools:

Using tcpdump to monitor the network:

[root@node prompt]# ifconfig eth0 promisc          - Put nic into promiscuous mode to sniff traffic.
[root@node prompt]# tcpdump -n host not XXX.XXX.XXX.XXX | more       - Sniff traffic but ignore given IP address which is your remote session.
[root@node prompt]# ifconfig eth0 -promisc         - Pull nic out of promiscuous mode.

Network Intrusion and Hacker Detection Systems:

SNORT: Monitor the network, performing real-time traffic analysis and packet logging on IP networks for the detection of an attack or probe.

Living in a MS/Windows World:

Related Links:

Test Internet Bandwidth:

Man Pages:

Books:

"Networking Linux: A Practical Guide to TCP/IP"
by Pat Eyler
ISBN # 0735710317, New Riders Publishing

Amazon.com
"LINUX TCP/IP Network Administration
by Scott Mann, Mitchell Krell
ISBN # 0130322202, rentice Hall PTR

Amazon.com
"Red Hat Linux 9 Unleashed"
by Bill Ball, Hoyt Duff
Sams, ISBN# 0672325888

I have the Red Hat 6 version and I have found it to be very helpful. I have found it to be way more complete than the other Linux books. It is the most complete general Linux book in publication. While other books in the "Unleashed" series have dissapointed me, this book is the best out there.

Amazon.com
"Redhat Linux 9 (Visual QuickPro Guide)"
by Harold Davis
ISBN #032121918X, Peachpit Press, Addison Wesley

The best basic Linux book around for the GUI generation. This book can be best described as a guide to using the GUI configuration tools.

Amazon.com

Return to http://yolinux.com/ for more Linux links, information and tutorials
Return to YoLinux Tutorial Index

Copyright © 2001, 2002, 2003 by Greg Ippolito