LPIC2 - 201-450

Basic Networking
1. Basic Network Configuration
In its basic format, the ifconfig command provides information about the network adapters installed
into the machine. Even though ifconfig is officially deprecated it’s still widely used:

$ ifconfig
eth0 Link encap:Ethernet HWaddr 00:0c:29:a0:ff:cc
inet addr:[Link] Bcast:[Link] Mask:[Link]
inet6 addr: fe80::20c:29ff:fea0:ffcc/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:389 errors:0 dropped:0 overruns:0 frame:0
TX packets:108 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:49636 (49.6 KB) TX bytes:14194 (14.1 KB)

lo Link encap:Local Loopback

inet addr:[Link] Mask:[Link]
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:135 errors:0 dropped:0 overruns:0 frame:0
TX packets:135 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:15414 (15.4 KB) TX bytes:15414 (15.4 KB)

Note: if ifconfig is not present install the net-tools package.

ifconfig can also be used to configure the network adapters. For example, to set a new IP address use
and another subnet mask use:

$ sudo ifconfig eth0 [Link] netmask [Link]

$ ifconfig
eth0 Link encap:Ethernet HWaddr 00:0c:29:a0:ff:cc
inet addr:[Link] Bcast:[Link] Mask:[Link]
...

Note that when setting network information through ifconfig, the changes will only be temporary. The
settings will revert after a reboot or if the interface gets disabled and re-enabled.

To disable and enable a network adapter use the ifdown and ifup commands respectively:

$ sudo ifdown eth0

ifdown: interface eth0 not configured
$ sudo ifup eth0
Ignoring unknown interface eth0=eth0.

Note however that these commands do not work from within a graphical environment. When in a GUI use
either the graphical applets to disable an interface or use ifconfig:

$ sudo ifconfig eth0 down

$ sudo ifconfig eth0 up
 LPIC2 - 201-450

Consistent Naming Scheme

With more and more LoM (LAN on Motherboard) and multiport NICs coming on the market the (previously
considered) inconsistent names of eth0, eth1, etc. have been replaced by the new Consistent Naming
Scheme. This scheme is managed by systemd and uses the address of the card as its name.

For example on a CentOS machine:

$ ifconfig
ens192: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet [Link] netmask [Link] broadcast [Link]
inet6 fe80::1d61:4baf:f299:8e31 prefixlen 64 scopeid 0x20<link>
ether 00:15:5d:00:31:80 txqueuelen 1000 (Ethernet)
RX packets 35448 bytes 10323949 (9.8 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 20833 bytes 1681920 (1.6 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

In this case en means Ethernet while s indicates a hot plug slot card. Other examples might look like:

• enp9s0 en for Ethernet, p9s0 for PCI in bus 9 slot 0.

• wlp12s0 wl for wireless, p12s0 for PCI in bus 12 slot 0.

There are 2 methods for disabling the Consistent Naming Scheme:

1. Add the HWADDR attribute to the network script file and either rename the file ifcfg-eth0 or
configure the DEVICE attribute.
2. Edit the /etc/grub file and append the following to the kernel line:
GRUB_CMDLINE_LINUX="crashkernel=auto biosdevname=0 [Link]=0 quiet"
Update the Grub configuration using # grub2-mkconfig -o /boot/grub2/[Link].

The ip command
The ip command is new way of displaying and setting network configurations. On a technical level it’s
more efficient than ifconfig because it uses netlink sockets rather than ioctl system calls. ip can
be used for a variety of tasks, it can be used to display and control devices, routing, policy-based routing
and tunneling. Its basic syntax is:

# ip [ OPTIONS ] OBJECT { COMMAND }

Some examples of ip include:

Command Explanation
ip link Show information for all network interfaces.
ip address show Show IP address information.
ip route show Display the routing table.
ip neighbor show Display the ARP cache.
ip -s link show eth0 Show information for eth0 only.
ip addr add [Link] dev eth0 Set the IP address for eth0.
ip link set eth0 down Bring eth0 down.
ip link set eth0 mtu 1480 Set the MTU for eth0 to 1480 bytes.
ip route add [Link]/24 via [Link] Set a networking route.
 LPIC2 - 201-450

ARP
The Address Resolution Protocol (ARP) maps layer 3 IP addresses to layer 2 MAC addresses. The ARP
cache containing these mappings can be displayed using the arp command which in turn lists the contents
of /proc/net/arp:

$ arp
Address HWtype HWaddress Flags Mask Iface
[Link] ether 00:0c:29:f4:ac:c0 C eth0
[Link] ether 00:15:5d:00:31:25 C eth0
[Link] ether 00:15:5d:00:31:80 C eth0

Use the -s parameter to add a static entry and -d to delete an entry. Persistent static entries have to be
added to the /etc/ethers file. Displaying the ARP cache with the ip command is done use the
neighbor show parameters:

$ ip neighbor show
[Link] dev eth0 lladdr 00:0c:29:f4:ac:c0 DELAY
[Link] dev eth0 lladdr 00:15:5d:00:31:25 STALE
[Link] dev eth0 lladdr 00:15:5d:00:31:80 STALE

Routing
The route command can be used to display the routing table. By default, networks will be resolved to
their names as specified in /etc/networks. Use the -n parameter to see numerical information only:

$ route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default gateway [Link] UG 100 0 0 eth0
[Link] [Link] [Link] U 100 0 0 eth0

$ route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
[Link] [Link] [Link] UG 100 0 0 eth0
[Link] [Link] [Link] U 100 0 0 eth0

An asterisk (*) in the output means that no gateway is required to reach a particular network. Possible
flags displayed for routes in the routing table include:

Flag Description
U Route is up.
H Target is host.
G Use gateway.
R Reinstate route for dynamic routing.
D Dynamically installed by daemon or redirect.
M Modified from routing daemon or redirect.
A Installed by addrconf.
C Cache entry.
! Reject route.

To add a default gateway to the routing table use the following command:

$ sudo route add default gw [Link]

Note: the network labeled ‘default’ is stored (and resolved from) the /etc/networks file.

Use the following command to add a specific route:

 LPIC2 - 201-450

$ sudo route add -net [Link] netmask [Link] gw [Link]

Access to a specific host or network can be blocked by using the reject parameter:

$ sudo route add -host [Link] reject

$ route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
[Link] [Link] [Link] UG 100 0 0 eth0
[Link] - [Link] !H 0 - 0 -
[Link] [Link] [Link] U 100 0 0 eth0

$ ping [Link]
connect: No route to host

Using the ip command for routing

When using the ip command append the route show parameters to display the routing table:

$ ip route show
default via [Link] dev eth0
[Link]/24 dev eth0 proto kernel scope link src [Link]

Routes can be added using the ip route add ... via commands

$ sudo ip route add [Link]/24 via [Link]

Configuration files
The location of network configuration files and scripts depends on the distribution. On CentOS, Red Hat,
Fedora and SUSE they’re located in the /etc/sysconfig/network-scripts/ directory. Settings for the
first network adapter (eth0) are stored in a file called ifcfg-eth0:

$ cat /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
BOOTPROTO=none
ONBOOT=yes
NETWORK=[Link]
NETMASK=[Link]
IPADDR=[Link]
USERCTL=no

The default gateway needs to be configured in another text-file which is simply called network:

$ cat /etc/sysconfig/network
NETWORKING=yes
HOSTNAME=centos
GATEWAY=[Link]

Note that RHEL 7 and SUSE-based systems no longer use /etc/sysconfig/network. These systems,
together with recent versions of Ubuntu (such as 14.04 LTS) use the hostnamectl utility instead which
arises from the Systemd infrastructure:

# hostnamectl --help

Changing the hostname is as simple as:

# hostnamectl set-hostname MYSERVER

 LPIC2 - 201-450

On Debian-based systems, all networking configuration, including gateways and DNS servers, is stored in a
file called /etc/network/interfaces. In this example, eth0 is configured with a static IP address:

$ cat /etc/network/interfaces
# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface

auto eth0
iface eth0 inet static
address [Link]
netmask [Link]
gateway [Link]
dns-nameservers [Link]
dns-nameservers [Link]
post-up route add -net [Link] netmask [Link] gw [Link]

Historically, the IP-addresses of DNS servers had to be configured in /etc/[Link]. On modern

systems, the contents of this file are handled automatically by the network initialization scripts.

To setup eth0 to use DHCP, enter:

# The primary network interface

auto eth0
iface eth0 inet dhcp

On Debian-based systems, changing the hostname requires making changes in 2 files:

• /etc/hostname
• /etc/hosts

Next, reboot the system for the changes to take effect. After the reboot use the hostname command to
verify the new hostname.

$ hostname
tux

Changes made to the configuration files are persistent and will stay after a reboot.
 LPIC2 - 201-450

Using the NetworkManager

The NetworkManager service appears in many different distributions including RHEL7 and Ubuntu 14.04.
It provides a GUI-based interface to ease Wi-Fi configuration and an easy mechanism to store many
configurations per interface.

To check whether the NetworkManager service is running use:

$ sudo systemctl status [Link]

A command-line version is offered through the nmtui utility and its ‘raw’ version in the form of the nmcli
utility. For example, to list all Wi-Fi networks in the area use:

$ nmcli device wifi list

The following command creates a connection profile for the wired NIC:

$ sudo nmcli connection add con-name wired-home ifname enp9s0 type ethernet \
ip4 [Link]/24 gw4 [Link]
$ sudo nmcli connection modify wired-home [Link] "[Link] [Link]"

The final configuration script for the profile will be stored in /etc/sysconfig/network-scripts/.

2. Advanced Network Configuration

The link speed and duplex settings can be changed by using the ethtool command:

$ sudo ethtool -s eth0 speed 1000 duplex full

To check the link status, use either the ethtool or mii-tool commands:

$ ethtool eth0
Supported ports: [ ]
Supported link modes: Not reported
Supported pause frame use: No
Supports auto-negotiation: No
Advertised link modes: Not reported
Advertised pause frame use: No
Advertised auto-negotiation: No
Speed: 1000Mb/s
Duplex: Unknown! (255)
Port: Other
PHYAD: 0
Transceiver: internal
 LPIC2 - 201-450

Auto-negotiation: off
Link detected: yes

$ mii-tool eth0

Sometimes it’s necessary to blacklist (network) hardware and prevent their module from being loaded by
the kernel. On Ubuntu and CentOS, this is done by adding the module to the
/etc/modprobe.d/[Link] file:

$ cat /etc/modprobe.d/[Link]
# This file lists those modules which we don't want to be loaded by
# alias expansion, usually so some other driver will be loaded for the
# device instead.

# evbug is a debug tool that should be loaded explicitly

blacklist evbug

# these drivers are very simple, the HID drivers are usually preferred
blacklist usbmouse
blacklist usbkbd

# replaced by e100
blacklist eepro100
...

Another advanced layer 2 configuration option is to add a MAC VLAN to a NIC. A MAC VLAN is an
additional layer 2 MAC address added to an interface:

$ sudo ip link add link eth0 dev peth0 type macvlan

$ sudo ip link set up dev peth0

Trunking and VLANs

Ubuntu supports VLANs out of the box but a user space tool needs to be installed to create the VLAN
aware interfaces:

$ sudo apt-get install vlan

Start with loading the 8021q module into the kernel:

$ sudo modprobe 8021q

Next, create a new interface that is a member of the desired VLAN. This interface must be based on a
physical interface, creating VLANs on virtual interface (such as eth0:0) is not supported. In this example,
eth1 and VLAN 73 are used:

$ sudo vconfig add eth1 73

Assign an IP address to the new interface:

$ sudo ip addr add [Link]/24 dev eth1.73

Start the new interface:

$ sudo ip link set up eth1.73

 LPIC2 - 201-450

Make the change permanent:

1. Add the module to the kernel on boot:

$ sudo su -c 'echo "8021q" >> /etc/modules'

2. Create the interface and make it available on boot, add the following lines to
/etc/network/interfaces:
auto eth1.73
iface eth1.73 inet static
address [Link]
netmask [Link]
vlan-raw-device eth1

Using the proc filesystem

The /proc filesystem contains settings that affect the network stack:

• /proc/sys/net/ipv4/ip_forward
Allows for network traffic to be forwarded from one interface to another. Essentially this turns the
machine into a router.

• /proc/sys/net/ipv4/conf/*/accept_redirects
Accepts ICMP redirects from a router to find better routes. Note that this setting has the potential
to be exploited by an attacker in an attempt to redirect traffic.

• /proc/sys/net/ipv4/icmp_echo_ignore_all
Affects the host’s visibility to ICMP ping packets.

• /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
Changes the host’s visibility to broadcast ICMP ping packets.

These files can be written to directly in order to make changes while the system is running. Another option
is using the sysctl command. Use sysctl with the -a parameter to display all configured options in
/proc:

$ sysctl -a
...
[Link] = 0
[Link].mc_forwarding = 0
[Link] = 0
[Link].mc_forwarding = 0
[Link] = 0
...

A value can be changed (e.g. written to) by using the -w parameter:

$ sudo sysctl -w "net.ipv4.ip_forward=1"

net.ipv4.ip_forward = 1

Settings made in either the /proc files or by the sysctl command are not persistent across reboots. To
make changes persistent, change either the /etc/[Link] file:

$ cat /etc/[Link]
...
# Uncomment the next line to enable packet forwarding for IPv4
#net.ipv4.ip_forward=1

# Uncomment the next line to enable packet forwarding for IPv6

 LPIC2 - 201-450

# Enabling this option disables Stateless Address Autoconfiguration

# based on Router Advertisements for this host
#[Link]=1
...

The contents of /etc/[Link] are loaded at boot time. To force the system to apply these settings
use the sysctl command with the -p parameter:

$ sudo sysctl -p

3. Configuring Wireless Networking

Wireless networking settings are stored in the /etc/wpa_supplicant/wpa_supplicant.conf
configuration file. In this file, network definitions are stored that provide the settings for connecting to a
wireless network, for example:

network={
ssid="CORP-WLAN"
psk="s0m3sup3rs3cr3tk3y"
proto=RSN
key_mgmt=WPA-PSK
pairwise=CCMP TKIP
}

To find out which wireless networks are available use the iwlist command:

$ sudo iwlist wlan0 scan

Use the iwconfig command to show the configuration of the wireless adapter, or examine the contents
of /etc/proc/net/wireless:

$ iwconfig wlan0
$ cat /proc/net/wireless

More configuration, including status information, can be displayed using the wpa_cli status command:

$ sudo wpa_cli status

4. Network Troubleshooting
Network troubleshooting starts with looking at the network configuration of the machine itself:

1. Check if an IP address is assigned to an interface either manually or through DHCP.

2. Check if a correct subnet mask and gateway are set.
3. Check for blocked ports by the firewall using the iptables -L command.
4. Check for correct name resolution:
a. Check the order of lookups in /etc/[Link].
b. Use dig or host to check the name entries.
c. Check /etc/[Link] along with the ifcfg- files and
/etc/network/interfaces depending on the distribution in use.
5. If the service supports TCP wrappers check the /etc/[Link] and /etc/[Link] files.
To check whether a service supports TCP wrappers use:
$ sudo ldd <path_to_service> | grep libwrap.
6. Check the system log files at /var/log/messages or /var/log/syslog. If SELinux is enabled
check the audit log file at /var/log/audit/[Link].
 LPIC2 - 201-450

Using ping
Like all other operating systems, Linux supports the ping command. Keep in mind though that ICMP traffic
can be blocked.

$ ping [Link]
PING [Link] ([Link]) 56(84) bytes of data.
64 bytes from [Link] ([Link]): icmp_seq=1 ttl=47 time=15.3 ms
64 bytes from [Link] ([Link]): icmp_seq=2 ttl=47 time=14.1 ms
64 bytes from [Link] ([Link]): icmp_seq=3 ttl=47 time=16.9 ms
^C
--- [Link] ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2008ms
rtt min/avg/max/mdev = 14.171/15.485/16.984/1.160 ms

Traceroute is a computer network diagnostic tool for displaying the route (path) and measuring transit
delays of packets across an Internet Protocol (IP) network. The history of the route is recorded as the
round-trip times of the packets received from each successive host (remote node) in the route (path); the
sum of the mean times in each hop indicates the total time spent to establish the connection.

$ traceroute [Link]
traceroute to [Link] ([Link]), 30 hops max, 60 byte packets
1 [Link] 2.084 ms 2.035 ms 1.954 ms
2 [Link] ([Link]) 9.128 ms 9.760 ms 10.699 ms
3 [Link] ([Link]) 13.198 ms 13.875 ms 14.191 ms
4 [Link] ([Link]) 14.552 ms 16.466 ms 18.691 ms
...

By default, traceroute uses a sequence of UDP packets. Traceroute can be executed in ICMP mode as well
by specifying the -I parameter, however doing so requires root privileges:

$ traceroute -I [Link]
You do not have enough privileges to use this traceroute method.
socket: Operation not permitted
$ sudo traceroute -I [Link]
traceroute to [Link] ([Link]), 30 hops max, 60 byte packets
1 [Link] 5.284 ms 5.389 ms 5.305 ms
2 [Link] ([Link]) 5.536 ms * *
3 * * *
4 [Link] ([Link]) 12.979 ms 15.145 ms 15.471 ms
...

Tracepath is an alternative to traceroute. It solely functions using UDP and requires no root privileges:

$ tracepath [Link]
1?: [LOCALHOST] pmtu 1500
1: [Link] 5.324ms
1: [Link] 2.002ms
2: [Link] 9.399ms
3: [Link] 16.183ms
...
 LPIC2 - 201-450

Using tcpdump
The tcpdump utility is a command line packet sniffer. In its basic format, all tcpdump requires is the name
of the interface from which to capture packets:

$ sudo tcpdump -i eth0

Apply the -c parameter to specify the amount of packets to capture and the not parameter to exclude
certain traffic from being captured, for example:

$ sudo tcpdump -c 5 -i eth0 not port 22

Exclude the not parameter to only capture traffic on a particular port.

Using IPTraf
IPTraf is a software-based console that provides network statistics.[1] It works by collecting information
from TCP connections, such as statistics and activity interfaces and drops TCP and UDP traffic.
 LPIC2 - 201-450

5. Discover open ports

The netstat command returns a wealth of information about the ports that are open on the local system.
Using it with the -tuna parameter set shows remote hosts by IP address, it shows sockets that are
listening and those that are not listening and it lists both UDP and TCP ports:

$ netstat -tuna
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 [Link]:631 [Link]:* LISTEN
tcp 0 0 [Link]:25 [Link]:* LISTEN
tcp 0 0 [Link]:53 [Link]:* LISTEN
tcp6 0 0 ::1:631 :::* LISTEN
tcp6 0 0 :::25 :::* LISTEN
tcp6 0 0 :::80 :::* LISTEN
tcp6 1 0 ::1:50307 ::1:631 CLOSE_WAIT
udp 0 0 [Link]:60939 [Link]:*
udp 0 0 [Link]:631 [Link]:*
udp 0 0 [Link]:53 [Link]:*
udp 0 0 [Link]:68 [Link]:*
udp 0 0 [Link]:123 [Link]:*
udp 0 0 [Link]:123 [Link]:*
udp 0 0 [Link]:5353 [Link]:*
udp6 0 0 :::35279 :::*
udp6 0 0 fe80::20c:29ff:fead:123 :::*
udp6 0 0 ::1:123 :::*
udp6 0 0 :::123 :::*
udp6 0 0 :::38089 :::*
udp6 0 0 :::5353 :::*

Netstat can also be used to display the routing table using the -nr parameters:

$ netstat -nr

lsof
The lsof command performs almost the same function as netstat. When using the -i parameter, lsof
shows all listening ports. Augment this with a protocol and a port number to only show this information:

$ sudo lsof -iTCP:22

The @ parameter can be used to only show connections to or from to a particular host:

$ sudo lsof -i@[Link]

Nmap
Nmap (Network Mapper) is a security scanner used to discover hosts and services on a computer network,
thus creating a "map" of the network. To accomplish its goal, Nmap sends specially crafted packets to the
target host and then analyzes the responses.

Nmap features include:

• Host discovery, identifying hosts on a network. For example, listing the hosts that respond to TCP
and/or ICMP requests or have a particular port open.
• Port scanning, enumerating the open ports on target hosts.
• Version detection, interrogating network services on remote devices to determine application
name and version number.
• OS detection, determining the operating system and hardware characteristics of network devices.
• Scriptable interaction with the target.
 LPIC2 - 201-450

To scan a single host simply start nmap with a hostname or IP address:

$ sudo nmap [Link]

Starting Nmap 6.40 ( [Link] ) at 2015-07-15 22:00 CEST

Nmap scan report for [Link]
Host is up (0.0022s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
9000/tcp open cslistener
30000/tcp open unknown
MAC Address: 00:90:A9:68:C9:BF (Western Digital)

This will have Nmap initiate a TCP scan (with a full 3-way handshake) which can be initiated by standard
users as it uses the default UNIX connect() libraries. Using the -sS option performs a SYN scan which
uses only SYN packets instead and as a bonus the MAC address of the remote host will be displayed. Note
that a SYN scan does require root privileges.

6. Configure Client Side DNS

To query DNS name servers, Linux provides the dig (domain information groper) tool. dig is useful for
network troubleshooting and for educational purposes. It can operate in interactive command line mode
or in batch mode by reading requests from a file.

When a specific name server is not specified in the command invocation, it will use the operating systems
default resolver, usually configured via the [Link] file. Without any arguments it queries the DNS
root zone.

$ dig [Link]

; <<>> DiG 9.9.5-3ubuntu0.2-Ubuntu <<>> [Link]

;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30161
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;[Link]. IN A

;; ANSWER SECTION:
[Link]. 27 IN A [Link]
[Link]. 27 IN A [Link]
[Link]. 27 IN A [Link]
[Link]. 27 IN A [Link]
[Link]. 27 IN A [Link]
[Link]. 27 IN A [Link]

;; Query time: 2 msec

;; SERVER: [Link]#53([Link])
;; WHEN: Wed Jul 15 21:12:34 CEST 2015
;; MSG SIZE rcvd: 139
 LPIC2 - 201-450

To have dig use a remote DNS server, use the @ symbol and the IP address of DNS server to use:

$ dig @[Link] [Link]

; <<>> DiG 9.9.5-3ubuntu0.2-Ubuntu <<>> @[Link] [Link]

; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31203
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

...
[Link]. 299 IN A [Link]

;; Query time: 32 msec

;; SERVER: [Link]#53([Link])
;; WHEN: Wed Jul 15 21:16:54 CEST 2015
;; MSG SIZE rcvd: 135

By default, entries in the /etc/hosts file take precedence over results coming from a DNS server. When
issuing a DNS record lookup, if the system finds an entry in its hosts file, it will not contact a DNS server.

The precedence of the hosts file is controlled through a file called /etc/[Link]:

$ cat /etc/[Link]
# /etc/[Link]
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd: compat
group: compat
shadow: compat

hosts: files dns

networks: files
...