Lab: Networking foundations - inspect the stack on a real host

This lab walks through the four TCP/IP layers on a live host. By the end you will have produced a complete inventory of the host’s networking state and can answer “what is on this host?” without guessing.

Objective

By the end of this lab, you can:

• Inventory link state, MAC, and MTU on every interface.
• Read IPv4 and IPv6 address and route state.
• Read the neighbour cache and explain each entry.
• List every listening TCP and UDP socket and explain what it is for.
• Trace a single socket all the way back to the physical NIC.

Architecture

The host has:

• A loopback interface (lo).
• One or two physical Ethernet interfaces (eth0, eth0, etc.).
• One or more link-local IPv6 addresses (automatic).
• A global IPv4 and possibly IPv6 address (from DHCP or static configuration).
• A default route via the local gateway.
• Several listening services (sshd at minimum; a web server and DNS resolver are useful if available).

Tasks

Task 1: Link-layer inventory

ip -br link show
ip -d link show eth0
ethtool eth0
ethtool -k eth0 | head -20

For each interface, write down:

• Interface name.
• MAC address.
• MTU.
• State (UP / DOWN).
• Speed and duplex (from ethtool).
• Driver and bus info (from ip -d).

Repeat for every physical interface on the host.

Task 2: Network-layer inventory

ip -4 addr show
ip -6 addr show
ip -4 route show
ip -6 route show

For each interface, write down:

• All IPv4 addresses and their prefix lengths.
• All IPv6 addresses and their prefix lengths. Distinguish link-local (fe80::/10), unique-local (fd00::/8 — the locally-assignable half of fc00::/7), and global (2000::/3).
• The default route(s) and gateway(s).

Task 3: Neighbour cache inventory

ip neigh show
ip -4 neigh show
ip -6 neigh show

For each entry, note:

• IP address (and zone identifier for IPv6 link-local).
• MAC address.
• Interface.
• State (REACHABLE, STALE, DELAY, PROBE, FAILED, INCOMPLETE).
• Whether it is marked router.

Most entries will be STALE for hosts that are not currently communicating. The gateway should be REACHABLE or STALE.

Task 4: Transport-layer inventory

ss -tlnp
ss -ulnp
ss -tnp state established

For every listening socket, write down:

• Protocol (TCP or UDP).
• Local address (note 0.0.0.0 / [::] for “all interfaces”).
• Local port.
• Process and PID.

Confirm that each listening service is one you expect. An unexpected service listening on a public interface is a finding worth investigating.

Task 5: Trace a socket to a NIC

Pick one listening socket (for example, sshd on TCP/22).

Walk from the socket to the physical NIC:

ss -tlnp 'sport = :22'
ip -4 route get 1.1.1.1
ip neigh show
ip -s link show eth0

The chain is:

1. The socket is bound to a local IP (from /proc/net/tcp).
2. Outbound packets follow the route to the gateway (from ip route get).
3. ARP/ND resolves the gateway’s MAC (from ip neigh).
4. Frames go out the NIC identified by that interface (from ip link).
5. The NIC’s counters (from ip -s link) show the frames being transmitted.

Draw this chain on paper or in a diagram tool. It is the mental model you will use for every future network diagnosis.

Task 6: DNS resolution test

cat /etc/resolv.conf
dig example.com
dig +short example.com
dig -x 1.1.1.1
resolvectl status   # systemd-resolved

Note:

• The configured resolvers.
• Whether systemd-resolved is in use.
• The TTL of the answers.
• Any SERVFAIL or NXDOMAIN responses (these are findings).

Validation

• Every interface has its link state, MAC, and MTU documented.
• Every IPv4 and IPv6 address is documented with prefix length and scope.
• The neighbour cache has been reviewed and explained.
• Every listening socket has been identified and confirmed expected.
• A complete chain from one socket to a physical NIC has been drawn.
• DNS resolution is verified end-to-end.

Cleanup

This lab is read-only. No state changes are required.

What you learned

• A Linux host’s networking state lives in four places: link (interfaces and MAC), network (addresses and routes), neighbour (ARP/ND cache), and transport (sockets).
• Every network problem is a problem at one of these layers. Reading all four is the foundation of network diagnosis.
• The chain from socket to physical NIC is the same for every protocol: socket -> route -> neighbour -> link -> NIC.