Advanced

 Linux  System  Administra3on  

Topic  11.  Network  administra3on  (Introduc3on).  

Pablo  Abad  Fidalgo  

José Ángel Herrero Velasco
Departamento  de  Ingeniería  Informá2ca  y  Electrónica  

Este  tema  se  publica  bajo  Licencia:  

Crea2ve  Commons  BY-­‐NC-­‐SA  4.0  
Index  
• Introduc,on  (TCP/IP).  
• Network  Interface.  
• Link  Layer.  
• Network  Layer.  
• Monitoring/Test.  
Introduc,on  (TCP/IP)  
• Protocol  “Suite”,  a  set  of  protocols  designed  to  implement  
interconnec7on  networks:  
– Origin:  research  project  of  the  USA  defense  department  (ARPANET).  
• Mul7ple  components,  arranged  hierarchically  (stack).  

arp   ssh,  hJp   Gaming   traceroute   Applica7on  Layer  

TCP   UDP   Transport  Layer  

IP   ICMP   Network  Layer  

ARP,  drivers   Link  Layer  

Copper,  fiber,  wireless   Physical  Layer  

Introduc,on  (TCP/IP)  
• Protocol  “Suite”,  a  set  of  protocols  designed  to  implement  
interconnec7on  networks:  
– Origin:  research  project  of  the  USA  defense  department  (ARPANET).  
• Mul7ple  components,  arranged  hierarchically  (stack):  
– UDP,  User  Datagram  Protocol,  unverified,  one-­‐way  data  delivery.  
– TCP,  Transmission  Control  Protocol,  reliable,  full  duplex,  flow  controlled,  
error  corrected  conversa7ons.  
– IP,  the  Internet  Protocol,  routes  data  packets  from  one  machine  to  
another.  
– ICMP,  the  Internet  Control  Message  Protocol,  provides  low  level  support  
for  IP:  error  messages,  rou7ng  assistance,  debugging.  
– ARP,  Address  Resolu7on  Protocol,  translates  IP  addresses  into  HW  
address  (MAC).  
Introduc,on  (TCP/IP)  
• Encapsula,on:  
– Data  travels  on  the  network  in  the  form  of  packets,  bursts  of  data  with  
a  maximum  length  imposed  by  the  link  layer.  
– Each  packet  consists  of  a  header  and  a  payload:  
• Header:  includes  Source-­‐Des7na7on  and  protocol  informa7on.  
• Payload:  the  informa7on  (Data).  
– As  a  packet  travels  down  the  TCP/IP  protocol  stack,  each  protocol  adds  
its  own  header  informa7on.  

Ethernet  Header   IP  Header   UDP  Header   Applica7on  Data   CRC  Eth.  

14  bytes   20  bytes   8  bytes   100  bytes   4  bytes  

UDP  Packet  (108  bytes)  

IP  Packet  (128  bytes)  
Ethernet  Packet  (146  bytes)  
Introduc,on  (TCP/IP)  
• Packet  Addressing:  mul7ple  addressing  schemes  (at  different  layers):  
– HW  Addressing  (link  layer):    
• Each  net  interface  has  one  MAC  addr  that  dis7nguishes  it  in  the  physical  network.  
• Ethernet  Network:  6  byte  direc7on  (2-­‐digit  hex  bytes:  00:50:8D:9A:3B:DF).  
– IP  Addressing  (IPv4:  [Link]):  
• Iden7fies  the  network  interface  in  Internet.  Unique  at  global  level*  (NAT  &  private  addr).  
• Physical  Address  –  IP  address  mapping:  ARP  protocol.  
– Hostname  Addressing:  
• Number-­‐based  direc7ons  hard  to  remember  ([Link]  ??).  Name  mapping.    
• File  mapping  (  /etc/hosts)  or  DNS  (world-­‐wide  Domain  Name  Server).  
– Ports:  
• IP  iden7fies  the  interface,  How  to  iden7fy  ac7ve  services?  (mul7ple  connec7ons).  
• Extend  IP  address  with  port  number:  16  bits  iden7fying  a  communica7on  channel.  
• Standard  services  (ssh,  gp,  hhp)  are  associated  to  pre-­‐established  ports  (  /etc/services).  
Introduc,on  (TCP/IP)  
• IP  Addressing:
– IPv4  vs  IPv6:  IPv4  limita7ons  (3  february  2011  no  more  addresses  available):
• [Link]  (may  2017,  below  20%).

– Types  of  IPv4  addresses:  (32  bits  divided  into  4  8-­‐bit  fields  a.b.c.d):
• Determines  which  por7on  iden7fies  the  network  and  which  one  the  host.
• Class  A:  (N.H.H.H)  1.x.x.x  –  127.x.x.x  (Apple,  AT&T,  Ford,  US  DoD…):
– Network  part=a,  126  nets.
– Host  part=b.c.d,  +16  millon  hosts  at  each  net.
[Link]:  My  own  Host  (NO  net  connec7on)  
• Class  B:  (N.N.H.H)  128.x.x.x  –  191.x.x.x: 0.x.x.x:  One  machine  in  our  network  
– +16K  nets,  65K  hosts  per  net. [Link]:  Loopback.  Does  not  reach  the  NIC.  
• Class  C:  (N.N.N.H)  192.x.x.x  –  233.x.x.x. [Link]:  Bcast  in  local  network.  
x.x.x.255:  Bcast  in  specified  network.  
• Classes  D  and  E:  [Link]  –  255.x.x.x:
– Experimental  networks  and  mul7cast  addressing.

– SubneVng:  A  &  B  oversized,  break  classes  into  subclasses:

• Part  of  the  host  iden7fier  is  employed  to  iden7fy  the  network.
• Through  the  network  mask  (mapping).
Index  
• Introduc,on  (TCP/IP).  
• Network  Interface.  
• Link  Layer.  
• Network  Layer.  
• Monitoring/Test.  
Network  Interface  
• Host  /  Interface:  
– Hosts  are  computers/individual  systems.  
– Each  host  can  have  one  or  more  network  interfaces  (NICs)  (Cable  +  WIFI):  
• Each  interface  represents  a  connec7on  to  a  different  network  (different  IP).  

• Basic  network  equipment:  

– Hubs  (level  OSI-­‐1):  Only  interconnects  wires.  
– Switches  (level  OSI-­‐2):  Ethernet  level  management  (ARP,  MAC,  etc.).  
– Routers  (level  OSI-­‐3):  IP  packet  management,  network  level.  
– Others:  traffic  balancing,  firewalls…  
• Linux  does  not  perform  net  management  through  device  files:  
– ethX  has  no  device  file  associated  (  /dev/ethX  not  found).  
– NICs  are  managed  through  kernel  modules  (drivers).  
Network  Interface  
• Configura7on  (Debian):  file  /etc/network/interfaces:  
– Establishes  the  configura7on  of  network  interfaces.  
– Allows  addi7onal  func7onality:  routes*,  alias,  pre/post  opera7ons…  
– Fields:  
• auto  <interface>:  ac7vates  the  interface  when  the  system  boots  up.  
• iface  <interface>  <ip_addressing>  <method>:  interface  configura7on:  
– ip_addressing:  inet  (IPv4)  /  inet6  (IPv6).  
– method:  dhcp  (automa7c)  /  sta7c  (manual,  requires  addi7onal  lines  for  configura7on).  

– *Loopback  interface:  
• Communica7on  of  network  apps   auto eth0
iface eth0 inet static
hosted  in  the  same  system.   address [Link]
netmask [Link]
• auth  lo.   network [Link]
broadcast [Link]
gateway [Link]
Network  Interface  
• Configura7on  (Debian):    
– Interface  configura7on  can  be  modified  in  a  “running”  system:  
• STEP  1.  Modifica7on.  Edit  the  file  (  /etc/network/interfaces  or  command  ifconfig).  
• STEP  2.  Re-­‐start.  ifdown/ifup  or  reboot  the  service  (  /etc/init.d/networking  restart).  
– Commands  ifup/ifdown:  power  on/off  a  network  interface:  
• Syntax:  ifdown  eth0  (power  off  eth0  card).  
– Command  ifconfig:  net  parameter  configura7on:  
• Syntax:  ifconfig  <interface>  <address>  <op7ons>:  
– Example:  ifconfig    eth0    [Link]    netmask    [Link]    broadcast    [Link]    up.  
– ifconfig  –a  prints  informa7on  about  available  interfaces.  

• Cau7on!!  Changes  made  with  ifconfig  are  not  permanent  (do  not  modify  interfaces  file).  

• Graphic  tools:  network-­‐admin,  webmin…  

Network  Interface  
• DHCP  (Dynamic  Host  Configura7on  Protocol):  
– The  DHCP  service  performs  automa,c  network  configura,on  
for  the  system:  
• “Ren7ng”  parameters  from  a  server:  IP,  Gateway,  DNS,  etc.  
• “Safe”:  allows  forcing  network  configura7on  based  on  MAC  address.  
• Easier:  centralized  management  of  the  whole  network.  
• Dynamic:  informa7on  is  only  valid  temporally.  
• Requires  a  “client”  service  at  each  host.  
– How  to  specify  we  want  to  use  DHCP:  
• In  /etc/network/interfaces:  
iface ethX inet dhcp

• man  dhclient.  
• ifconfig  eth0  up.  
Index  
• Introduc,on  (TCP/IP).  
• Network  Interface.  
• Link  Layer.  
• Network  Layer.  
• Monitoring/Test.  
Link  Layer  
• The  physical  level  in  TCP/IP,  almost  always  a  ethernet  network:    
– Each  interface  (NIC)  has  a  unique  MAC  address.  
– Layer  in  charge  of  IP  Frame  <–>  Ethernet  Frame  conversion:  
• Need  to  map  IP  address  and  MAC  Address:  ARP  (Address  Resolu7on  Protocol).  
– ARP  Protocol:  
• Search  @MAC  corresponding  to  a  @IP  in  the  local  ARP  table  (translated  address  
cache).  
• If  not  in  the  table,  it  performs  a  broadcast  and  the  receiver  informs.  ARP  table  is  
updated  for  future  connec7ons.  
• When  des7na7on  is  not  in  local  network,  the  IP  route  tables  are  employed,  sending  
the  message  through  the  gateway  MAC.  
– Command  arp:  manipula7on/display  of  ARP  table.  
– Configura7on/Modifica7on  of  @MAC:    
• #  ifconfig  eth0  hw  ether  00:02:B3:19:C8:21.  
Index  
• Introduc,on  (TCP/IP).  
• Network  Interface.  
• Link  Layer.  
• Network  Layer.  
• Monitoring/Test.  
Network  Layer  
• Through  ARP  only  hosts  in  my  net  segment  can  be  reached:  
– Cannot  reach  further  than  my  hub/switch/router.  
– IP  routes  must  be  established  for  external  addresses.  
• Route  Tables:  informa7on  about  how  to  reach  IP  des7na7ons:  
– Des,na,on:  iden7fies  des7na7on  network.  
– Gateway:  how  to  reach  to  Des7na7on  (*  means  no  forwarding  is  
required,  the  packet  is  already  in  that  network).  
– Genmask:  network  mask  (iden7fies  the  subnetwork).  
– Iface:  network  interface  to  reach  des7na7on  network.  

Destination Gateway Genmask Flags Metric Ref Use Iface

[Link] * [Link] U 0 0 0 eth1
[Link] * [Link] U 0 0 0 lo
default [Link] [Link] UG 0 0 0 eth1
Network  Layer  
• Manual  configura7on  of  route  tables:  
– Command  route:  modify/show  tables:  
• #route  –n:  shows  route  tables.  
• Add  a  route  for  a  network  segment:  
– #  route    add    –net    [Link]    netmask    [Link]    eth0.  

• Add  the  link  element  to  other  subnetworks  (default  route):  

– #  route    add    default    gw    [Link]    eth0.  

• Dynamic  routes  (automa7c):  

– Sta7c  configura7on  of  tables  limits  their  func7onality:  
• Valid  for  stable  networks  (not  very  large…).  
• Requires  knowledge  about  network  topology.  
– Complex  environments:  Dynamic  Routes:  
• Daemon  “routed”  or  “gated”.  OSFP,  RIP,  BGP…  
• Maybe  one  of  the  most  complex  aspects  concerning  network  administra7on.  
Network  Layer  
• Network  Address  Transla,on  (NAT):  
– Rou7ng  mechanism  for  packet  exchange  between  incompa7ble  
networks  (Public-­‐Private  address):  
• Allows  a  private  IP  to  maintain  internet  connec7vity.  
• For  outgoing  connec7ons,  the  router  translates  the  private  IP  as  its  own  IP.  
• Router  keeps  informa7on  about  all  outgoing  connec7ons,  rela7ng  them  with  
incoming  ones:  
– Outgoing  connec7on:  [Link](1085)  -­‐>  [Link](1085).  
– Inbound  communica7on:  [Link](1085)  -­‐>  [Link](1085).  

– NAT  Types:  
• Sta,c  NAT:  one-­‐to-­‐one  mapping,  each  private  IP  is  assigned  a  dedicated  public  IP.  
• Dynamic  NAT:  the  router  has  a  pool  of  public  IPS  assigned  dynamically  to  the  
private  IPs  making  a  request.  
• Port  Address  Transla,on  (PAT):  single  public  IP.  The  port  iden7fies  the  private  IP.  
Network  Layer  
• Network  Address  Transla,on  (NAT):  
Network  Layer  
• Name  Resolu,on:  
– Name  <-­‐>  IP  transla7on,  the  network  phonebook.  
– Op7on  1.  Through  the  file  /etc/hosts:  
• Conven7onal  way,  edi7ng  the  file  manually  or  through  the  command  addhost.  
• Reasonable  for  small  and  private  networks.  Not  useful  for  the  rest  of  cases:  
– Adding  a  new  host  requires  modifying  all  the  /etc/hosts  files  in  the  network.  

• Usually  employed  only  for  the  values  required  during  boot  process  (localhost,  
hostname…).  
• Can  add  the  IPs  of  relevant  network  servers  or  those  providing  essen7al  network  
services.  
– Op7on  2.  Domain  Name  Service  (DNS):  
• Dedicated  server  in  charge  of  performing  the  conversion.  
• Each  host  must  be  configured  to  make  use  of  its  corresponding  name  server.  
• The  client  is  configured  through  the  file  /etc/[Link].  
Network  Layer  
• Name  Resolu,on:  the  file  /etc/[Link]:  
– search:  domain  search  order:  
• When  we  try  to  connect  to  a  host  without  suffix,  it  auto-­‐completes.  
• ssh  si  -­‐>  ssh  [Link].  
• Priority  from  leg  to  right  (first  [Link],  then  [Link]).  
– nameserver:  name  server:  
• Try  to  resolve  with  the  first  one.    
• If  it  fails,  keep  on  descending  to  lower  lines.  

search localdomain
search [Link] [Link]

nameserver [Link]
nameserver [Link]
nameserver [Link]
Index  
• Introduc,on  (TCP/IP).  
• Network  Interface.  
• Link  Layer.  
• Network  Layer.  
• Monitoring/Test.  
Monitoring/Test  
• Test  Command:  
– Command  netstat:  shows  network  status:  
• Route  table  (–r),  ac7ve  connec7ons  (–a).  Also  sockets  (TCP).  
– Command  ping:  packet  ECHO_REQUEST  (ICMP)  to  a  host:  
• Check  if  a  des7na7on  is  reachable  (warning,  firewall  &  ICMP).  
– Command  traceroute:  route  followed  by  a  packet  towards  des7na7on:  
• Collects  the  IP  at  each  gateway  traversed.  

• Command/Tools  for  monitoring:  

– Command  iptraf:  traffic  sta7s7cs  at  network  interfaces.  
– tcpdump/Wireshark/…:  monitoring  sent/received  data  for  each  connec7on.  
– netperf:  performance  measurement  for  links.  
– More  sophis7cated  ones:  MRTG,  SAINT,  Ganglia-­‐monitor…