TCP/IP

Question

Why did the internet go with TCP/IP protocol suite?

Answer

Largely to the elegant and flexible design of TCP/IP and its open and nonproprietary protocol suite.
TCP/IP doesn’t rely on any particular hardware or OS.

RFCs

The technical activities of the Internet community are summarized in documents known as Requests for Comments or RFCs. In addition to standardizing the Internet protocols, the RFC mechanism sometimes just documents or explains aspects of existing practice.

Once distributed, the contents of an RFC are never changed. Updates are distributed as new RFCs with their own reference numbers. Updates may either extend and clarify existing RFCs or supersede them entirely.

RFC

Hardware (MAC) addressing

Each of a host’s network interfaces usually has one link-layer MAC address that distinguishes it from other machines on the physical network, plus one or more IP addresses that identify the interface on the global Internet

Important

IP addresses identify network interfaces, not machines.
A packet is delivered to a specific network interface, the OS decides which process or service should receive it.

Vendor ID embedded in a MAC address can be misleading.

In theory, Ethernet hardware addresses are permanently assigned and immutable. However, many network interfaces let you override the hardware address and set one of your own choosing.

Ports

IP addresses identify a machine’s network interfaces, but they are not specific enough to address individual processes or services. TCP and UDP extend IP addresses with a concept known as a port.

Definition

Port: a 16-bit number that combined with an IP address to specify a particular communication channel. Valid ports are in the range 1–65,535.
IP address gets you to the machine, port gets you to the specific thing running on that machine.

Although both TCP and UDP have ports and those ports have the same sets of potential values, the port spaces are entirely separate and unrelated. Firewalls must be configured separately for each of these protocols.

To help prevent impersonation of system services, UNIX systems restrict programs from binding to port numbers under 1,024 unless they are run as root or have an appropriate Linux capability.
Today, privileged ports are more nuisance than security benefit. Running services on unprivileged ports as nonroot users and forwarding traffic through a load balancer is often more secure, it limits unnecessary root privileges and adds a layer of infrastructure abstraction.

IP Addresses

Internet addresses have network and host portions. The network is the logical network and the host is the node on that network.

sudo apt install ipcalc
ipcalc 10.0.14.76/27 # awesome cli tool for subnetting

IPv6

Question

Why hasn’t IPv6 been adopted yet?

Answer

The underlying issue that limits IPv6’s adoption is that IPv4 support remains mandatory for a device to be a functional citizen of the Internet.
Currently: your choice is not between IPv4 and IPv6; it’s between supporting IPv4 alone and supporting both IPv4 and IPv6.

IPv6 is a well designed protocol that improves on IPv4, in someways it’s easier to administrator than IPv4 with fewer hacks (NAT) in the end it’s just a cleaned up version of IPv4 with a larger address space. Because you need to manage it alongside IPv4 elimates any potential efficieny gains.

Implementation

Network/host are fixed /64.

├─── leading zeros can be removed :000a: -> :a:
└──┬ contiguous zero compressed into -> :: 
   ├─ only use :: compression once on the largest contiguous group of zeros
   └─ cant replace a single group of zeros -> :0000: -> :0: (instead of ::)

NAT

Question

How does NAT work?

Answer

NAT intercepts packets addressed with internal address and rewrites their source address using a valid external IP address and a different source port number, it maintains a table of the mappings it has made between internal and external address/port pairs so that the translation can be performed in reverse when answering packets arrive from the internet.

A problem with NAT is an arbitary host on the Internet cannot initiate connections to your site’s internal machines. The fix is port forwarding “when incoming traffic arrives on external IP:port X forward it to internal IP:port Y

External traffic hitting 203.0.113.42:2222 -> forward to 192.168.1.15:22 (SSH server)

Routing

Definition

Routing: the process of directing a packet through the maze of networks between it’s source and destination

Routing means two things:

• looking up a network address in a table
• builing the routing table

A host can route packets only to gateway machines that are reachable through a directly connected network. The local hosts job is only to determine the next hop so it’s pointless to store information about non-adjacent gateways in the local table.

Network interfaces and IP configuration

ip link show

Linux naming conventions:

# Prefixes
en = ethernet
wl = wirless (802.11)
ww = cellular (WWAN)

# Examples
enpXsY = wired (ethernet), PCI slot X, port Y
enp0s3 = first wired interface
eno1 = onboard ethernet
wlpXsY = wireless, PCI slot X, port Y
wwpXsY = cellular/mobile

# Legacy
ethX = old naming

Routing configuration

It may be that no route matches the destination address. In this case, the default route is invoked if one exists. Otherwise, an ICMP “network unreachable” or “host unreachable” message is returned to the sender. On the Internet backbone, the routers do not have default routes. If there is no routing entry for a destination, that destination cannot be reached.

# You can use a dns record for a route
ip route add 10.0.0.0/24 via router1.pawney.net

Tools

netstat is obsolete, replaced by ss and ip route

ip route

ip route show # show routes
ip route show default

# Add routes
ip route add default via 10.0.0.1 dev eth0 # optionally specify interface
ip route add default via 10.0.0.1
ip route add default dev eth0 

# Remove routes, exact same as add but del
ip route remove default via 10.0.0.1 dev eth0 

After any change to a file that controls network configuration at boot time, you may need either to reboot or to bring the network interface down and then up again for your change to take effect.

ifdown interface 
ifup interface

IP command - manually configure networks

Linux systems formerly used the same basic commands for network configuration and status checking as traditional UNIX: ifconfig, route, and netstat. These are still available on most distributions, but active development has moved on to the iproute2 package, which features the commands:

• ip (for most everyday network configuration)
• ss (for examining the state of network sockets).

ip takes a second argument for what object you want to configure

ip link # network interfaces
ip address # binding network addresses to interfaces
ip route # ip routing

# Most of these can be abbreviated
ip ad
ip addr

# Most object understand list and show, which are aliases for each other (same outputs)
ip link show
ip address list
ip route show

# The man pages are divided by sub-command
man ip-link
man ip-route
man ip-address

NetworkManager

In 2004 NetworkManager released and Linux started to migrate over to it

• Designed to be run and managed by users rather than system administrators
• NetworkManager has been widely adopted by Linux distributions
• In an effort to avoid breaking existing scripts and setups, it’s usually made available in parallel to static file configurations
• For servers and desktop systems (not laptops), NetworkManager isn’t necessary and may in fact complicate administration. In these environments, it should be ignored or configured out.

In daily life you won’t normally be setting up network addresses by hand, with ip.
The next sections describe how distributions handle static configuration of the network from the perspective of configuration files.

Debian

# Check what you have:
systemctl status NetworkManager
systemctl status systemd-networkd

# If using ifupdown (no NM):
cat /etc/network/interfaces
sudo vim /etc/network/interfaces
sudo ifup eth0
sudo ifdown eth0
sudo systemctl restart networking

# If using NetworkManager:
nmcli device show
nmcli connection show
nmcli device wifi list
nmcli connection add con-name mynet ifname eth0 type ethernet ip4 192.168.1.100/24

Ubuntu

# Check what you have:
netplan status
cat /etc/netplan/00-installer-config.yaml

# Edit config:
sudo vim /etc/netplan/00-installer-config.yaml

# Apply changes:
sudo netplan apply

# Info:
netplan get
ip addr show

Key diff from Debian: Ubuntu uses netplan (YAML abstraction) for both, not /etc/network/interfaces. Netplan picks the backend (NM vs systemd-networkd) under the hood.

Ethtool

Query or control network driver and hardware settings.

sudo ethtool enp5s0
sudo ethtool -r # force renegotiation of speed

All these changes are transient, you need to have them run at boot time in /etc/network/interfaces or whichever network manager runs boot scripts.

Network Troubleshooting

• One change at a time. Test each. Revert if it breaks something.
• Document everything. Before state, every change you make.
• Work systematically. Pick one end (client or server) and trace through components to the problem.
• Or use the stack. Start at the top or bottom of the protocol layers and work through.

Working up the stack

Layer 1 (Physical)

Do you have a link light?

ethtool <interface>
ip link show

Layer 2 (Data Link)

Is your interface configured properly?

ip link show
# Look for "state UP" vs DOWN

Do your ARP tables show other hosts?

ip neigh
arp -a

Layer 3 (Network)

Is your routing correct?

ip route show
# default via 192.168.2.1 dev enp5s0 proto dhcp src 192.168.2.11 metric 100    DEFAULT
# 10.0.0.0/24 via 192.168.2.34 dev enp5s0 proto static metric 100              ROUTE TO ANOTHER NET

Is there a firewall? Do they allow ICMP?

ping <gateway>
nc -vz 10.0.0.1 8080

Can you ping localhost, can you ping other hosts by IP?

ping 127.0.0.1
ping 192.168.2.4 -n # -n disables reverse dns lookup

Can you ping hosts on another network?

ping 8.8.8.8
traceroute 8.8.8.8 -n # no dns

Layer 7 (Application)

Is DNS working? Can you ping hosts by hostname?

# genent goes through the real system dns stack to see if the system CAN 
# resolve the name, rather than the alternatives who by bypass to test other things.
getent hosts <hostname>      # Will THIS system resolve it?
dig <hostname>               # Is DNS infrastructure working?

Do high level services work? (curl)

curl http://example.com

traceroute

Traceroute used to require setuid permisisons to craft such ICMP, but linux kernel has since changed to allow it.

# defines which Group IDs (GIDs) are allowed to create ICMP Echo sockets without root privileges
# this control can come in handy for containers
/proc/sys/net/ipv4/ping_group_range
0       2147483647
# this is a range of allowed GUIs to perform this action
# 0 - infinity
# you could do 0 - 1000 

tcpdump

sudo apt install tcpdump

sudo tcpdump host google.ca # filter for host
sudo tcp src net 192.168.1.0/24 and dst port 80 # filter for http

Wireshark is the GUI version of this with some added features, it uses the same underlying libpcap library. One gotcha is display filters in wireshark only change what you’re viewing not capturing. Wireshark has a ton of CVEs always update.

Network Monitioring

Smokeping

Containerzed drop in ping monitor of a handful of sites, could be useful for quick testing. Really ugly though.

https://hub.docker.com/r/linuxserver/smokeping https://github.com/oetiker/SmokePing

services:
  smokeping:
    image: lscr.io/linuxserver/smokeping:latest
    container_name: smokeping
    hostname: smokeping #optional
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - CACHE_DIR=/tmp #optional
    volumes:
      - /path/to/smokeping/config:/config
      - /path/to/smokeping/data:/data
    ports:
      - 80:80
    restart: unless-stopped

iPerf

track network performance - ping based tools are good for verifiyng reachablility but they cant analyze and track network performance.

https://iperf.fr/

1. Install iperf on both machines

2. Start the server

   iperf -s # start the server

3. Connect from the client

   iperf -c server.ip