NETWORKING PART II

Complete Exam Notes & Command Reference

Abdelkader BELAHCENE · ENSTA · 2026

Chapter Topics Covered

Chapter 1 Most Common Servers: Switch, OpenSSL/RSA, SSH, FTP, DNS, DHCP,
Apache
Chapter 2 Introduction to Security: Firewall, iptables, tables, chains, targets, rules
Chapter 3 Introduction to Router Behaviour: VLANs, Inter-VLAN Routing, Bridges, Policy
Routing
Chapter 1 — Most Common Servers
Switch · OpenSSL / RSA · SSH · FTP · DNS · DHCP · Apache Web Server

1.1 How a Switch Works

A switch connects devices in a LAN using MAC addresses. It maintains a CAM Table (MAC Address
Table) mapping port → MAC. The IP address is invisible to the switch — it operates at Layer 2.

Step-by-step — PC1 sends data to PC2:

Phase Actor Action
① ARP PC1 Checks ARP cache. Not found → broadcasts "Who has [Link]?"
Request
Switch Floods frame out every port (broadcast MAC FF:FF:FF:FF:FF:FF)
② ARP PC2 Recognises its IP → unicasts ARP reply to PC1
Reply
Switch Records Source MAC → Port in its CAM table
PC1 Stores [Link] → MAC in its ARP table
③ Data Tx PC1 Sends frame with PC2's MAC as destination
Switch Looks up CAM table → forwards only to PC2's port

MEMORY AID: Switch = MAC-only device. Think "Switch sees Stamps (MAC), Router reads
Addresses (IP)"

NOTE: Layer 3 switches are hybrids (router + switch). Standard switches do NOT store IPs.

Key encapsulation layers:

•​ IP address lives inside the Packet (Layer 3)
•​ MAC address lives in the Frame (Layer 2 envelope)
•​ Switch only opens the envelope → sees MAC → forwards → never reads IP

1.2 OpenSSL & Asymmetric Keys

Data is protected using asymmetric (public/private) key cryptography. The private key stays secret; the
public key is shared freely. OpenSSL supports RSA, DSA, ECDSA.

General Syntax:
openssl [options] -in <input> -out <output> [-inkey key] [-pubin]
command = genrsa | rsa | pkeyutl | dgst | req | x509 ...
Essential RSA Commands:
Command / Syntax What it does
openssl genrsa -out [Link] 2048 Generate 2048-bit RSA private key
openssl rsa -in [Link] -pubout Display/extract public key (stdout)
openssl rsa -in [Link] -pubout -out [Link] Save public key to file
openssl rsa -in [Link] -text -noout Show full key details as text
openssl rsa -pubin -in [Link] -text -noout Show public key details
openssl pkeyutl -encrypt -pubin -inkey Encrypt a file with public key
[Link] -in [Link] -out [Link]
openssl pkeyutl -decrypt -inkey [Link] -in Decrypt with private key
[Link] -out [Link]
openssl dgst -sha256 -sign [Link] -out Sign file (hashes then encrypts hash)
[Link] [Link]
openssl dgst -sha256 -verify [Link] Verify signature → "Verified OK"
-signature [Link] [Link]

diff [Link] [Link] Verify decryption matches original

IMPORTANT: Sign the HASH of the file (not the file itself) — files can be large; hashes are fixed-size
and faster to encrypt/verify.

1.3 SSH — Secure Shell

SSH uses the same public/private key system. The ssh package wraps cryptography into convenient
commands.

General SSH Syntax:

# Connect
ssh [-X] [-p PORT] user@server ["remote command"]
-X = X11 forwarding (run GUI apps) | -p = custom port (default 22)

# Remote Copy (scp)

scp [-r] [-P PORT] source user@server:/path
-r = recursive (folders) | -P (uppercase!) = port number

Command / Syntax What it does

sudo systemctl status ssh Check if SSH service is running
sudo apt install openssh-server Install SSH server (Debian/Ubuntu)
ssh user@[Link] Connect with password
 ssh -X user@server Connect + allow GUI apps (X11 forwarding)
ssh user@server -p 4567 Connect on custom port 4567
ssh user@server -p 2345 "ls /" Run remote command and return
scp [Link] user@server:/home/user/ Copy file to remote server
scp -r myDir user@server:/home/user/ Copy folder to remote server
scp -P 4567 -r myDir user@server:/path Copy folder on custom port
ssh-keygen -t rsa Generate RSA key pair (~/.ssh/id_rsa)
ssh-copy-id -i ~/.ssh/id_rsa.pub user@server Push public key to server (passwordless login)
sudo ufw disable Disable firewall (for testing)

IMPORTANT: SCP port flag is -P (uppercase). SSH port flag is -p (lowercase). They are different!

SSH Server Configuration — edit /etc/ssh/sshd_config:

•​ Change port: Port 4567
•​ Enable/disable X11: X11Forwarding yes/no
•​ After changes: sudo systemctl restart ssh

crontab — Scheduled Tasks:

MIN HOUR DAY MONTH WEEKDAY command
Example: 20 4 * * * tar czf [Link] *.c → runs daily at 04:20

Command What it does

crontab [Link] Load cron jobs from file
crontab -l List current cron jobs
crontab -r Remove all cron jobs
tar czf [Link] /path/ Create compressed archive

MEMORY AID: Passwordless automation = ssh-keygen → ssh-copy-id → crontab. No interactive

password needed!

1.4 FTP Server (vsftpd)

vsftpd = Very Secure FTP Daemon. Uses port 21. Config file: /etc/[Link]

Command / Syntax What it does

sudo apt install vsftpd Install vsftpd
sudo systemctl status vsftpd Check status
 sudo systemctl start/stop/restart vsftpd Control service
ftp user@server Connect with credentials
ftp anonymous@server Connect anonymously

Key /etc/[Link] options:

Option Value Effect
anonymous_enable YES / NO Allow anonymous connections
local_enable YES / NO Allow local system user login
write_enable YES / NO Allow write/upload operations
chroot_local_user YES / NO Jail user to their home directory
allow_writeable_chroot YES / NO Required when chroot=YES and homedir is
writable
anon_upload_enable YES / NO Allow anonymous uploads (not recommended)
anon_mkdir_write_enable YES / NO Allow anonymous directory creation

FTP Client Commands (interactive ftp session):

Command What it does
ls / pwd / lpwd List remote / show remote dir / show local dir
cd dir / lcd dir Change remote / local directory
get [Link] Download file from server
put [Link] Upload file to server
mget *.txt / mput *.txt Download/upload multiple files
get [Link] [Link] Download and rename

NOTE: Standard ftp does NOT support recursive folder transfers. Use lftp or GUI tools (gftp, filezilla)
for directories.

1.5 DNS Server (BIND9)

DNS maps hostnames ↔ IP addresses. We use BIND9 (package: bind9). Config dir: /etc/bind/. DNS
port: 53.

Setup sequence:
•​ 1. Set machine hostname/domain
•​ 2. Assign static IP & configure /etc/[Link]
•​ 3. Install bind9 & edit zone files
•​ 4. Validate config & restart bind9
 Command / Syntax What it does
hostnamectl Show current hostname and domain
hostnamectl set-hostname [Link] Set FQDN (Fully Qualified Domain Name)
sudo apt install bind9 bind9utils Install DNS server
named-checkconf Validate [Link] syntax
named-checkzone [Link] /etc/bind/[Link] Validate zone file
sudo systemctl restart bind9 Apply changes
cat /etc/[Link] Show DNS resolver config

/etc/[Link] — tells clients which DNS to use:

search [Link] # auto-complete short names → FQDN
nameserver [Link] # our local DNS server
nameserver [Link] # fallback: Google DNS

NOTE: NetworkManager auto-regenerates /etc/[Link]. Lock it with: chattr +i /etc/[Link]

/etc/bind/[Link] — declare your zone:

zone "[Link]" {
type master;
file "/etc/bind/[Link]";
};

/etc/bind/[Link] — zone data file:

$TTL 604800
@ IN SOA [Link]. [Link]. (
5 ; Serial ← increment on every change!
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
@ IN NS [Link]. # NS record: who is authoritative
@ IN A [Link] # zone root IP
belaLap IN A [Link] # DNS server itself
oldLap IN A [Link] # another machine
myWeb IN A [Link] # web server
 IMPORTANT: Always end domain names with a dot (.) in zone files! "[Link]." not "[Link]" — the
dot prevents auto-appending the zone name.

Multi-LAN DNS — /etc/bind/[Link]:

options {
directory "/var/cache/bind";
recursion yes;
allow-query { [Link]/24; [Link]/24; };
allow-recursion { [Link]/24; [Link]/24; };
};

1.6 DHCP Server (isc-dhcp-server)

DHCP automatically assigns IP addresses. Ports: Client → Server UDP 68→67. Config:
/etc/dhcp/[Link]

Command / Syntax What it does

sudo apt install isc-dhcp-server Install DHCP server
sudo systemctl status isc-dhcp-server Check status
grep INTERFACESv4 /etc/default/isc-dhcp-server Show listening interface
cat /var/lib/dhcp/[Link] Show current IP leases

/etc/default/isc-dhcp-server — set listening interface:

INTERFACESv4="eth0"

/etc/dhcp/[Link] — basic configuration:

# Global settings
default-lease-time 600; # 10 min (testing); use 86400 in production
max-lease-time 7200; # 2 hours max
authoritative; # this is THE official DHCP server

# Define the subnet scope

subnet [Link] netmask [Link] {
range [Link] [Link];
option subnet-mask [Link];
option broadcast-address [Link];
option domain-name "[Link]";
option routers [Link];
 option domain-name-servers [Link], [Link];
}

# Static reservation by MAC address

host webserver {
hardware ethernet B8:8D:12:01:4B:A8;
fixed-address [Link];
}

MEMORY AID: DHCP gives: IP + Subnet mask + Gateway + DNS + Domain name. It distributes a full
network config in one broadcast exchange!

1.7 Apache Web Server

Package: apache2. Config root: /etc/apache2/. Default web root: /var/www/html/. Log dir:
/var/log/apache2/

Command / Syntax What it does

sudo apt install apache2 Install Apache
sudo systemctl status/start/stop apache2 Control service
sudo systemctl restart apache2 Restart after config changes
a2ensite [Link] Enable a virtual host site
a2dissite [Link] Disable a site
a2enmod module_name Enable a module (e.g. userdir)
a2dismod module_name Disable a module
htpasswd -c /path/.htpasswd username Create password file for directory protection

Key config files:

•​ [Link] — main config, includes all others
•​ [Link] — listening ports (80=http, 443=https)
•​ sites-available/ → sites-enabled/ — virtual host configs (symlinked to enable)
•​ mods-available/ → mods-enabled/ — module configs

Virtual Host (second site on port 8000):

# /etc/apache2/sites-available/[Link]
ServerAdmin admin@localhost
DocumentRoot /var/www/html2
ErrorLog ${APACHE_LOG_DIR}/[Link]
# Also add "Listen 8000" to [Link]!
Directory Options Summary:
Option Effect
Options Indexes Show directory listing if no [Link]
Options -Indexes DENY directory listing (security best practice)
FollowSymLinks Apache follows symlinks to serve linked files
AllowOverride None .htaccess files ignored
AllowOverride All .htaccess fully active
Require all granted Allow everyone
ServerSignature Off Hide Apache version in error pages
ServerTokens Prod Minimise version info in HTTP headers
Chapter 2 — Introduction to Security
Firewall · iptables · Tables · Chains · Targets · Rules

2.1 Security Fundamentals

Security is built on three pillars (CIA):

CIA Pillar Definition

Confidentiality Prevents access by unauthorized users
Integrity Prevents alteration or destruction by illegitimate users
Availability Guarantees access to legitimate users when needed

MEMORY AID: Remember CIA: Confidentiality – Integrity – Availability. Also: first line = physical
security!

2.2 Firewall & iptables

iptables is the standard Linux firewall tool. It uses the kernel's netfilter framework to filter packets. It
manages 3 tables:

Table Purpose Default Chains

filter (default) Allow/block packets — THE firewall table INPUT, OUTPUT, FORWARD
nat Modify source/dest IPs (SNAT, DNAT, PREROUTING,
Masquerade) POSTROUTING, OUTPUT
mangle Modify packet fields (TTL, TOS, MARK) All 5 chains
for QoS

Chains — where in the packet flow a rule applies:

Chain When Applied Used For
PREROUTING Before routing decision DNAT (redirect incoming packet to different
IP)
INPUT Packet destined for THIS Firewall rules protecting local services
machine
FORWARD Packet passing THROUGH When machine acts as router/gateway
machine
OUTPUT Packet leaving THIS Control what our machine sends out
machine
POSTROUTING After routing decision SNAT/MASQUERADE (share internet
connection)
Targets — what to do with a matching packet:
Target Action Sender Notified?
ACCEPT Allow the packet through —
DROP Silently discard packet No (stealth)
REJECT Discard + send ICMP "unreachable" back to Yes (ICMP error)
sender
RETURN Jump back to calling (parent) chain —
QUEUE Pass to user-space application for processing —

iptables General Syntax:

iptables [-t TABLE] -ACTION CHAIN [match options] -j TARGET

TABLE: filter(default) | nat | mangle

ACTION: -A append, -I insert, -D delete, -P policy

Essential iptables Commands:

Command / Syntax What it does
iptables -L List all rules (filter table)
iptables -L INPUT List INPUT chain rules
iptables -t nat -L List NAT table rules
iptables -S Show rules as commands (re-runnable)
iptables -F Flush (delete) all rules in filter table
iptables -t filter -F Flush filter table rules
iptables -t filter -X Delete custom chains
iptables -P INPUT DROP Set default policy to DROP (deny all)
iptables -A INPUT -p tcp --dport 22 -j ACCEPT Allow incoming SSH
iptables -A INPUT -p tcp --dport 80 -j ACCEPT Allow incoming HTTP
iptables -A INPUT -p tcp --dport 443 -j Allow incoming HTTPS
ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT Allow incoming DNS queries
iptables -A OUTPUT -p udp --dport 53 -j Allow outgoing DNS lookups
ACCEPT
iptables -A INPUT -p icmp -j ACCEPT Allow ping (ICMP)
iptables -A INPUT -i lo -j ACCEPT Allow loopback interface (localhost)
iptables -A INPUT -m state --state Allow established connections (stateful)
RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -s [Link] -j DROP Block specific source IP
 iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT Forward traffic between interfaces
iptables -t filter -D INPUT 1 Delete rule #1 from INPUT chain
/sbin/iptables-save Save rules to file
apt install iptables-persistent && Persist rules across reboots
netfilter-persistent save

Typical Secure Server Ruleset (order matters!):

# 1. Clear existing rules
iptables -t filter -F && iptables -t filter -X

# 2. Default policy: deny everything

iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP

# 3. Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# 4. Allow established/related connections

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# 5. Allow specific services

iptables -A INPUT -p tcp --dport 22 -j ACCEPT # SSH
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT # HTTPS
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT # ping
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT # DNS out
iptables -A INPUT -p udp --dport 53 -j ACCEPT # DNS server

IMPORTANT: Rule order matters! Rules are evaluated top-to-bottom, first match wins. Always set
default policy BEFORE specific rules.

MEMORY AID: FTP connection states: port 21 control = ESTABLISHED. Port data transfer =
RELATED. Allow RELATED,ESTABLISHED covers both!
Packet flow through netfilter:
Incoming → PREROUTING (mangle) → PREROUTING (nat) → Routing Decision → [if local] INPUT
(filter) → Local Process → OUTPUT (filter) → POSTROUTING (nat) → Network
For forwarded packets: PREROUTING → FORWARD (filter) → POSTROUTING → out
Chapter 3 — Introduction to Router Behaviour
VLANs · Inter-VLAN Routing · Linux Bridges · Policy Routing

3.1 VLANs — Virtual LANs

A VLAN is a logical broadcast domain created inside a switch. Devices in different VLANs cannot
communicate without a Layer-3 device (router).

Concept Details
VLAN ID 12-bit field → supports VLANs 1–4094
Access Port Connects to end devices (PCs). Untagged. Assigned to 1 VLAN.
Trunk Port Connects switch-to-switch or switch-to-router. Carries multiple VLANs
tagged with 802.1Q.
802.1Q Tag 4-byte tag inserted in Ethernet frame: TPID(0x8100) + Priority + VLAN ID
Broadcast Domain Stays inside the VLAN — ARP, DHCP broadcasts don't cross VLAN
boundaries

Key benefits of VLANs:

•​ Reduce broadcast traffic — broadcasts stay within VLAN
•​ Improve security — devices in different VLANs cannot see each other
•​ Logical grouping — group by department, not physical location

Frame tagging (802.1Q):

•​ PC sends a normal (untagged) frame to its access port
•​ Switch adds the 802.1Q tag when sending out on a trunk link
•​ Receiving switch removes the tag before delivering to the destination PC
•​ PCs never see VLAN tags — they are transparent

MEMORY AID: Access port = naked (untagged). Trunk port = dressed (802.1Q tagged). Switch
adds/removes the "clothes".

3.2 Inter-VLAN Routing

Devices in different VLANs need a router (Layer 3) to communicate. The router has sub-interfaces, one
per VLAN.

Flow: PC1 (VLAN10) → PC2 (VLAN20):

•​ PC1 sees PC2 is not in its subnet → sends to its default gateway (router's VLAN10 IP)
•​ Frame: Dest MAC = router's VLAN10 MAC, Dest IP = PC2's IP
•​ Switch forwards frame to trunk → router
 •​ Router strips VLAN10 tag → reads IP → looks up routing table → PC2 is in VLAN20
•​ Router creates new frame: Source MAC = router's VLAN20 MAC, Dest MAC = PC2's MAC
•​ Router sends frame with VLAN20 tag through trunk → switch → PC2

NOTE: MAC addresses are LOCAL to each subnet/VLAN. The router replaces the MAC header at
each hop — the IP stays unchanged end-to-end.

3.3 Linux Network Configuration Commands

General ip command syntax:
ip [OPTIONS] OBJECT COMMAND [arguments]
OBJECT: addr | link | route | rule | netns | neigh ...

Command / Syntax What it does

ip addr show Show all IP addresses
ip addr show dev eth0 Show IP on specific interface
ip addr add [Link]/24 dev eth0 Assign IP address to interface
ip link set eth0 up / down Enable / disable interface
ip route show Show routing table
ip route add [Link]/24 via Add a static route
[Link]
ip route add default via [Link] Add default gateway
ip route get [Link] Show which route would be used
ip route get X from Y Show route for source Y to dest X
ip rule show Show policy routing rules
ip rule add from [Link] table lan1 Route packets from IP via table lan1
ip netns add PC1 Create network namespace "PC1"
ip netns exec PC1 ip addr show Run command inside namespace PC1
ip link add veth1 type veth peer name veth1br Create a virtual cable (veth pair)
ip link set veth1 netns PC1 Move one veth end into namespace
ip link set veth1br master br0 Attach veth end to bridge br0

3.4 Policy-Based Routing (Multi-NIC Machine)

When a machine has multiple NICs, standard routing is ambiguous. Policy routing uses separate
routing tables per interface.

Setup sequence:
•​ 1. Assign IPs to each interface
 •​ 2. Name routing tables in /usr/share/iproute2/rt_tables (e.g. 100 lan1, 200 lan2)
•​ 3. Add routes to each table for its subnet + default gateway
•​ 4. Add ip rules so packets from each source IP use the right table

# Step 1: Assign IPs

sudo ip addr add [Link]/24 dev eth0
sudo ip addr add [Link]/24 dev eth1
sudo ip link set eth0 up && sudo ip link set eth1 up

# Step 2: Edit /usr/share/iproute2/rt_tables

# Add: 100 lan1
# Add: 200 lan2

# Step 3: Add routes to each table

sudo ip route add [Link]/24 dev eth0 src [Link] table lan1
sudo ip route add default via [Link] dev eth0 table lan1
sudo ip route add [Link]/24 dev eth1 src [Link] table lan2
sudo ip route add default via [Link] dev eth1 table lan2

# Step 4: Bind source IPs to tables

sudo ip rule add from [Link] table lan1
sudo ip rule add from [Link] table lan2

# Test
ping -I eth0 [Link]
ping -I eth1 [Link]
ip route get [Link] from [Link]

MEMORY AID: ip rule = "which table?". ip route = "where to go?". Rules select the table; the table
picks the path.

3.5 Linux Bridge & Virtual Network (Namespaces)

A Linux bridge (br0) simulates a network switch. Network namespaces simulate separate PCs. veth
pairs simulate cables.

Component map:
•​ bridge (br0) = switch
•​ network namespace (ip netns) = PC or router
•​ veth pair = virtual ethernet cable connecting PC to switch
 •​ VLAN filtering on bridge = trunk/access port config

Build a complete virtual network:

# 1. Create bridge (switch) with VLAN support
ip link add br0 type bridge vlan_filtering 1
ip link set br0 up

# 2. Create namespace (PC1)

ip netns add PC1

# 3. Create virtual cable + connect

ip link add veth1 type veth peer name veth1br
ip link set veth1 netns PC1 # plug into PC1
ip link set veth1br master br0 # plug into switch
ip link set veth1br up

# 4. Assign VLAN10 to PC1's port (untagged = access port)

bridge vlan add dev veth1br vid 10 pvid untagged

# 5. Configure PC1's IP inside its namespace

ip netns exec PC1 ip addr add [Link]/24 dev veth1
ip netns exec PC1 ip link set lo up
ip netns exec PC1 ip link set veth1 up

# 6. Router: create with trunk port (carries VLAN 10 + 20 tagged)

ip link add vethR type veth peer name vethRbr
ip link set vethR netns R1
ip link set vethRbr master br0
ip link set vethRbr up
bridge vlan add dev vethRbr vid 10 # trunk carries VLAN10
bridge vlan add dev vethRbr vid 20 # trunk carries VLAN20

# 7. Create VLAN sub-interfaces inside router namespace

ip netns exec R1 ip link add link vethR name vethR.10 type vlan id 10
ip netns exec R1 ip addr add [Link]/24 dev vethR.10
ip netns exec R1 ip link set vethR.10 up

# 8. Enable IP forwarding in router namespace

ip netns exec R1 sysctl -w net.ipv4.ip_forward=1
 # 9. Add default route in PCs
ip netns exec PC1 ip route add default via [Link]

IMPORTANT: lo (loopback) is NOT auto-enabled inside a namespace. Always run: ip netns exec
NAME ip link set lo up

Useful diagnostic commands:

Command / Syntax What it does
ip netns list List all network namespaces
ip netns exec PC1 ping [Link] Ping from inside namespace
bridge vlan show Show VLAN assignments on bridge ports
bridge fdb show Show MAC table of bridge
ip netns exec R1 ip route show Show routing table inside namespace
sysctl -w net.ipv4.ip_forward=1 Enable IP forwarding (host level)
ip link show master br0 Show all interfaces attached to bridge
Quick Reference & Cheat Sheet
Ports · Services · Key Commands at a Glance

Standard Port Numbers

Port Protocol Service
21 TCP FTP (command/control)
22 TCP SSH (Secure Shell)
25 TCP SMTP (email)
53 UDP/TCP DNS (Domain Name Service)
67 UDP DHCP Server (receives from client)
68 UDP DHCP Client (receives from server)
80 TCP HTTP (web, unencrypted)
123 UDP NTP (Network Time Protocol)
443 TCP HTTPS (web, encrypted)
8000/8443 TCP Common alternative web server ports

Command Syntax Master Patterns

Context Syntax Pattern
systemctl sudo systemctl {status|start|stop|restart|enable|disable} <service>
iptables iptables [-t TABLE] {-A|-I|-D} CHAIN [matches] -j TARGET
ip addr ip addr {add|del|show} [ADDR/PREFIX] [dev IFACE]
ip route ip route {add|del|show} [PREFIX via GW] [dev IFACE] [table NAME]
ip rule ip rule {add|del|show} from SRC_IP table TABLE_NAME
ip link ip link {add|set|del} NAME [type TYPE] [master BR] [up|down]
ip netns ip netns {add|del|exec|list} NAME [command]
bridge vlan bridge vlan {add|del|show} dev IFACE vid VID [pvid] [untagged]
scp scp [-r] [-P PORT] SRC USER@HOST:/DEST
ssh ssh [-X] [-p PORT] USER@HOST ["remote command"]
openssl rsa openssl rsa -in KEY [-pubout] [-text] [-noout] [-out OUTFILE]
openssl pkeyutl openssl pkeyutl {-encrypt|-decrypt} [-pubin] -inkey KEY -in IN -out OUT
openssl dgst openssl dgst -sha256 {-sign KEY | -verify PUB -signature SIG} FILE
hostnamectl hostnamectl [set-hostname [Link]]
crontab MIN HOUR DAY MON WEEKDAY command (crontab [Link] to load)
Memory Aids & Mnemonics
MEMORY AID: SWITCH = L2 only. Remembers MACs. Forwards frames. Never sees IPs.

MEMORY AID: ROUTER = L3. Uses IPs. Connects VLANs/networks. Replaces MAC headers at
each hop.

MEMORY AID: iptables rule order: -P DEFAULT → loopback → ESTABLISHED/RELATED → specific

services. Think "deny all, then whitelist".

MEMORY AID: DNS zone file: "." at end of FQDN = absolute. No dot = relative (zone appended).
Serial = must increment on every edit.

MEMORY AID: DHCP = IP + Mask + Gateway + DNS. The full "network identity card" delivered
automatically.

MEMORY AID: Policy routing: "which table?" = ip rule. "where to go?" = ip route. Source IP selects
table; table selects gateway.

MEMORY AID: veth pair = virtual patch cable. One end in namespace (PC), other end in bridge
(switch). Always create in pairs.

IMPORTANT: SCP port flag is -P (uppercase). SSH port flag is -p (lowercase). They are different!

IMPORTANT: After modifying /etc/[Link] or /etc/ssh/sshd_config always run: sudo systemctl

restart

IMPORTANT: loopback in netns is DOWN by default! Always: ip netns exec NAME ip link set lo up