<aside> 🌐
Module 13 — Networking
A server that can't reach the network is just a warm brick. This module teaches you to see and diagnose a machine's networking from the ground up: its addresses, how it decides where to send packets, which ports are open, and how names become addresses. When "the service is up but nobody can reach it," these are the tools — and the mental model — that find the break in minutes instead of hours.
Legend used throughout: 🧠 concept → 🧩 analogy → 🧪 exercise → ✅ expected result (hidden) → 🎯 interview questions (hidden)
</aside>
<aside> 🚦
Before you start
You need Modules Module 1 — What Linux Is–Module 12 — Storage, Disks, and Filesystems — especially processes and the ports they listen on (Module 8), services (Module 11: a "port" is a service listening), and /etc config files (Module 2). Tools: an Ubuntu 24.04 machine; ip and ss are built in, and we install dnsutils (for dig) in Part D. Read-only inspection (ip addr, ip route, ss, dig, reading /etc/resolv.conf) is safe anywhere. Firewall changes are marked — do those only where you won't lock yourself out. Your track already has dedicated DNS and SSL Certificates tracks — this module gives the working Linux-command view; those go deeper on the protocols.
</aside>
<aside> ℹ️
This page uses Mermaid diagram blocks. Notion shows them as code by default — click the block and set it to Preview to see the diagram. This reminder appears once per page.
</aside>
<aside> 📖
Official docs: ip(8)
</aside>
🧠 A machine talks to the network through interfaces — each a named connection point: lo (loopback, the machine talking to itself), eth0 or ens5 or enp0s3 (wired/virtual Ethernet — cloud VMs vary the name), wlan0 (wireless). The modern tool for all of it is ip (from the iproute2 package, Module 9): ip addr shows interfaces and their addresses, ip link shows the interfaces themselves (up/down, MAC address), ip -brief addr gives a clean one-line-per-interface summary. The old ifconfig you'll see in tutorials is deprecated — recognize it, but reach for ip.
<aside> 🧠
Counter-intuitive: lo (loopback, 127.0.0.1) is a real, critical interface that never touches a wire. It's how a machine talks to itself — a database and the app on the same host connect over 127.0.0.1 without any packet ever leaving the machine. It's always up, always 127.0.0.1, and a shocking number of "network" problems are actually loopback problems: a service bound only to 127.0.0.1 (localhost) is unreachable from other machines by design, even though the service is running perfectly and the network is fine. "Works locally, refused remotely" is very often this — the service is listening on loopback, not on the real interface. That distinction (Part C's 0.0.0.0 vs 127.0.0.1) resolves a whole category of "it's up but I can't reach it."
</aside>
<aside> 🧩
Real-world analogy — the building's doors
Interfaces are a building's doors to different places: the front door to the street (eth0), a wireless side entrance (wlan0), and an internal door that just loops back into the same building's lobby (lo). Each door has an address so deliveries know where to go. ip addr is the directory of every door and its address.
Where the analogy stops working. A building's internal loop-door seems pointless — why walk out a door back into your own lobby? But lo is heavily used: it's the fast, private channel for programs on one machine to talk as if over the network, using the same tools, without exposure. And a door being present (interface up) doesn't mean it leads anywhere — an interface can be up with no route to the outside (Part B), the networking equivalent of a door that opens onto a bricked-up wall.
</aside>
🧪 Exercise A1.1 — See the machine's interfaces (read-only, safe anywhere)
ip addr # full detail: interfaces and their addresses
ip -brief addr # the clean summary — one line per interface
ip link # the interfaces themselves (state, MAC address)
<aside> 📖
Official docs: ip(8)
</aside>
🧠 An IP address is a machine's number on a network — 192.0.2.2 (IPv4, four bytes) or the longer IPv6 form (2001:db8::1). The /24 after it is CIDR notation: how many bits are the network part versus the host part. 192.0.2.2/24 means "the first 24 bits (192.0.2) identify the network; the last 8 bits (.2) identify this host on it" — so 192.0.2.0 through 192.0.2.255 are all on the same local network and can talk directly; anything else needs routing (Part B). Two ranges to recognize instantly: private addresses (10.x, 172.16–31.x, 192.168.x) that only exist inside a local network and never route on the public internet, and public addresses that do. This private/public split is why your laptop's 192.168.1.5 and a million other laptops' 192.168.1.5 don't collide — they're each private to their own network.
<aside> 🧩
Real-world analogy — street addresses and postal districts
An IP address is a street address; the CIDR prefix is the postal district. Houses in the same district (192.0.2.0/24) can send mail directly hand-to-hand; mail to another district goes through the post office (the router/gateway). Private ranges are like internal office mail-stop numbers — "desk 192.168.1.5" is meaningful inside one building, and every building can reuse the same desk numbers because that mail never leaves the building.
Where the analogy stops working. Street addresses are globally unique; private IPs are deliberately not — the same 192.168.1.5 exists on millions of networks simultaneously, which works only because those packets never mix on the public internet (NAT, the address-translation at the boundary, is how a whole private network shares one public address — a Module-adjacent topic your DNS/networking tracks expand). The "address" metaphor breaks exactly where private addressing's cleverness lives: reuse without collision.
</aside>
🧪 Exercise A2.1 — Read your addressing (read-only, safe anywhere)
ip -brief addr # note the /NN on each address
ip addr show eth0 # (use your real interface name from A1.1) — full detail for one interface