Interfaces, Addresses, Routes, and DNS

1. Linux networking is a sequence of decisions

An application does not “send to the Internet” in one step. It resolves a destination name when necessary, creates a socket, selects a source address, asks the kernel routing tables for an output path, resolves a next-hop link-layer address on local Ethernet-like networks, and transmits through an interface. Each stage can fail independently.

flowchart TD
  A["Application name or IP"] --> B["Name service switch and DNS"]
  B --> C["Destination IP address"]
  C --> D["Routing policy and route table"]
  D --> E["Source address and output interface"]
  E --> F["Neighbor discovery: ARP or NDP"]
  F --> G["Link transmission"]
  G --> H["Routers and destination service"]

2. Interfaces represent packet entry and exit points

Linux exposes physical NICs, Wi-Fi devices, loopback, bridges, bonds, VLANs, tunnels, virtual Ethernet pairs, and container interfaces through a common link model. Interface names such as enp1s0, wlan0, br0, and veth... are identifiers, not guarantees about purpose.

# Compact link inventory
ip -brief link

# Detailed state, flags, MTU, MAC address, and counters
ip -details link show
ip -statistics link show

# Inspect one interface selected from the inventory
iface=$(ip -o link show | awk -F': ' '$2 != "lo" {print $2; exit}')
printf 'Selected interface: %s\n' "$iface"
ip -details -statistics link show dev "$iface"

Important flags include UP (administratively enabled), LOWER_UP (the lower layer reports connectivity), and NO-CARRIER. A link may be administratively up while lacking carrier, or carrier may exist while no usable address or route has been configured.

3. Addresses combine an identity with a prefix

An address such as 192.0.2.25/24 contains a host address and a prefix length. The prefix identifies which destinations are considered directly connected. IPv6 uses the same prefix concept, commonly with /64 on LANs. A host can have multiple addresses on one interface, including temporary, deprecated, link-local, and global addresses.

ip -brief address
ip address show scope global
ip -6 address show

# Machine-readable one-line format
ip -o address show

# Address chosen by the kernel for a destination
ip route get 1.1.1.1
ip -6 route get 2606:4700:4700::1111 2>/dev/null || true

4. Routes answer “where should this packet go?”

The kernel compares the destination with available prefixes and selects the most specific matching route. This is longest-prefix match. A host route such as /32 or /128 outranks a subnet route, which outranks the default route. Metrics typically break ties between otherwise comparable routes, but policy routing can add rules and additional tables.

ip route show
ip -6 route show
ip rule show

# Explain the selected path without sending traffic
ip route get 203.0.113.10

# Show all routing tables that contain entries
ip route show table all | sed -n '1,160p'

# Neighbor cache: IPv4 ARP and IPv6 NDP results
ip neighbor show

A default route is not “the Internet route”; it is the fallback used when no more specific route matches. The via address is a next-hop router reachable through the selected interface. Directly connected routes usually have no gateway because the destination or next hop is on the local link.

5. DNS turns names into data, but the local resolver has policy

Applications commonly call resolver library functions rather than reading DNS servers directly. The Name Service Switch configuration in /etc/nsswitch.conf determines whether files, DNS, mDNS, systemd-resolved, LDAP, or other sources are consulted. /etc/hosts can therefore override or supplement DNS for ordinary hostname lookups. On systems using systemd-resolved, /etc/resolv.conf may point to a local stub while per-link DNS servers and search domains live elsewhere.

grep '^hosts:' /etc/nsswitch.conf
getent hosts localhost
getent ahosts example.com 2>/dev/null || true

printf '%s\n' '--- /etc/resolv.conf ---'
ls -l /etc/resolv.conf
cat /etc/resolv.conf

# Available when systemd-resolved is active
resolvectl status 2>/dev/null || true

6. Hands-on lab: capture a network baseline

This lab is read-only. It creates a compact evidence bundle that can be compared before and after a network change.

lab="$HOME/devops-academy/linux/chapter12/lesson01"
mkdir -p "$lab"
cd "$lab"

ip -brief link > links.txt
ip -brief address > addresses.txt
ip route show table all > routes-ipv4.txt
ip -6 route show table all > routes-ipv6.txt 2>&1 || true
ip rule show > policy-rules.txt
ip neighbor show > neighbors.txt

{
  printf '=== nsswitch hosts ===\n'
  grep '^hosts:' /etc/nsswitch.conf || true
  printf '\n=== resolv.conf identity ===\n'
  ls -l /etc/resolv.conf
  printf '\n=== resolv.conf content ===\n'
  cat /etc/resolv.conf
  printf '\n=== selected route ===\n'
  ip route get 1.1.1.1 2>&1 || true
} > resolver-and-path.txt

sha256sum ./*.txt > evidence.sha256
wc -l ./*.txt

7. Common mental-model mistakes

8. Knowledge check

9. Summary

A Linux host reaches a destination through cooperating layers: interfaces carry packets, addresses identify endpoints and connected prefixes, routes select output paths, neighbor discovery reaches the next hop, and the resolver converts names according to local policy. Reliable troubleshooting records each layer separately before changing configuration.

10. Further reading

• ip(8), ip-address(8), and ip-route(8).
• ip-link(8), ip-neighbour(8), ip-rule(8), and nsswitch.conf(5).
• Distribution documentation for predictable interface names and resolver management.