Linux Advanced Networking, Firewalls, and Traffic Analysis

Linux provides a robust, enterprise-grade networking stack capable of advanced routing, network virtualization (bridges, VLANs, veth pairs), stateful firewall packet filtering (nftables, iptables), and deep packet inspection. This guide covers modern IP configuration, DNS resolution mechanics, firewall architectures, and real-time traffic troubleshooting with tcpdump.

⚡ Quick Dive

Networking & Packet Diagnostics Cheat Sheet

Task Command Example
List IP & MAC addresses ip -br a ip -br a (brief summary table)
Inspect Routing Table ip route show ip route show default
Add Static Route ip route add <net> via <gw> sudo ip route add 10.50.0.0/16 via 192.168.1.1
Trace Path & Loss mtr -rwc 100 <host> mtr -rwc 100 8.8.8.8 (100-packet loss report)
Capture HTTP Packets tcpdump -nn -i any port 80 sudo tcpdump -nn -i eth0 port 80 -A
Capture & Save PCAP tcpdump -w capture.pcap sudo tcpdump -i eth0 -w /tmp/traffic.pcap
Active Network Sockets ss -tulpn sudo ss -tulpn
Bandwidth Throughput iperf3 -c <server> iperf3 -c 10.0.0.5 -t 10
Inspect DNS Resolution resolvectl status resolvectl query example.com
Firewall Ruleset nft list ruleset sudo nft list ruleset

Quick tcpdump Filter Recipes

# 1. Capture DNS queries and responses
sudo tcpdump -nn -i any udp port 53

# 2. Capture TCP SYN connection packets (hunting connection attempts)
sudo tcpdump -nn -i eth0 'tcp[tcpflags] & (tcp-syn) != 0'

# 3. Capture traffic between host A and host B excluding SSH
sudo tcpdump -nn -i eth0 host 192.168.1.50 and not port 22

📖 Extended Guide

1. Modern IP Route & Link Management (iproute2)

The iproute2 suite (ip) completely replaces legacy net-tools (ifconfig, route, arp).

Interface & Link Management

# View link layer state (MAC addresses, MTU, carrier status)
ip link show

# Bring an interface up or down
sudo ip link set eth1 up
sudo ip link set eth1 down

# Assign a temporary IP address to an interface
sudo ip addr add 192.168.10.50/24 dev eth1
sudo ip addr del 192.168.10.50/24 dev eth1

Policy-Based Routing

# Show current default gateway
ip route show default

# Change default gateway
sudo ip route replace default via 192.168.1.254 dev eth0

# Check which interface and gateway will route a specific destination IP
ip route get 8.8.8.8

2. DNS Architecture & systemd-resolved

Modern Linux distributions manage DNS via systemd-resolved with a local stub resolver listening on 127.0.0.53:53.

# Check upstream DNS servers configured per interface
resolvectl status

# Query DNS using local resolver and show response latency/DNSSEC
resolvectl query api.github.com

# Flush local DNS cache
sudo resolvectl flush-caches

/etc/resolv.conf Integration

  • If managed by systemd-resolved, /etc/resolv.conf is a symlink to /run/systemd/resolve/stub-resolv.conf pointing to 127.0.0.53.
  • For static standalone servers, /etc/resolv.conf directly specifies nameserver 1.1.1.1.

3. Stateful Firewalls: nftables and iptables

Linux packet filtering happens inside the Netfilter kernel subsystem. nftables is the modern replacement for legacy iptables.

Network Packet In
       │
       ▼
   PREROUTING ──────> (Routing Decision) ──────> FORWARD ──────> POSTROUTING ──> Wire Out
  (DNAT/Port Fwd)              │                                (SNAT/Masquerade)
                               ▼
                             INPUT ──> Local Process ──> OUTPUT

Managing Firewalls with nftables

Configuration file: /etc/nftables.conf

# View active ruleset
sudo nft list ruleset

# Create a baseline secure firewall script
sudo nft add table inet filter
sudo nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
sudo nft add chain inet filter forward { type filter hook forward priority 0 \; policy drop \; }
sudo nft add chain inet filter output { type filter hook output priority 0 \; policy accept \; }

# Allow established/related connections and loopback
sudo nft add rule inet filter input ct state established,related accept
sudo nft add rule inet filter input iifname "lo" accept

# Allow SSH and HTTPS
sudo nft add rule inet filter input tcp dport 22 accept
sudo nft add rule inet filter input tcp dport 443 accept

Legacy iptables Quick Reference

# List active rules with packet/byte counters and numerical ports
sudo iptables -L -n -v --line-numbers

# Block a malicious IP address immediately
sudo iptables -I INPUT -s 203.0.113.45 -j DROP

# Allow incoming port 443
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

4. Deep Packet Inspection with tcpdump

tcpdump intercepts and analyzes raw packets passing through network interfaces.

Essential Command Flags

  • -i <interface>: Listen on specific interface (-i eth0 or -i any).
  • -n: Do not resolve IP addresses to hostnames (prevents misleading DNS delays).
  • -nn: Do not resolve IP addresses OR port numbers (80 instead of http).
  • -v / -vv / -vvv: Increased packet protocol decoding verbosity.
  • -X / -XX: Print payload in both Hex and ASCII.
  • -A: Print payload in ASCII (ideal for inspecting plain HTTP or API calls).
  • -w <file.pcap>: Write raw packets directly to Wireshark-compatible PCAP file.
  • -r <file.pcap>: Read and parse an existing PCAP file.

Advanced BPF (Berkeley Packet Filter) Expressions

# 1. Capture HTTP GET or POST requests
sudo tcpdump -s 0 -A -vv 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420 or tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354'

# 2. Capture ICMP ping packets only
sudo tcpdump -nn -i any icmp

# 3. Capture all traffic except SSH on port 22
sudo tcpdump -nn -i eth0 not port 22

5. Network Virtualization: Bridges and veth Pairs

Linux network virtualization powers container networks:

# 1. Create a Linux Bridge (virtual switch)
sudo ip link add name br0 type bridge
sudo ip addr add 172.20.0.1/16 dev br0
sudo ip link set br0 up

# 2. Create a virtual ethernet pair (veth)
sudo ip link add veth-host type veth peer name veth-guest

# 3. Attach one end to the bridge
sudo ip link set veth-host master br0
sudo ip link set veth-host up
⌂ All Guides