Networking basics: ip, ss, resolv.conf

general / published / guide #38 / ≈ 4 min read

If "I have no internet" or "this service isn't reachable" lands in your lap, you need a small toolkit for inspecting and tweaking a Linux machine's network stack. This guide is the friendly tour.

The cast

  • Interface — a network card. eth0/enp3s0 for wired, wlan0/wlp2s0 for Wi-Fi, lo for loopback.
  • IP address — the machine's address on a network.
  • Gateway — the router that forwards traffic destined elsewhere.
  • DNS — translates names like example.com into IP addresses.
  • Port — within an IP, a numbered slot a service listens on (22 = ssh, 80 = http, 443 = https, …).

Two essential commands

ip       # everything about interfaces, addresses, routes
ss       # what's listening and what's connected

If you've seen older tutorials with ifconfig and netstat: those still work on some distros, but they're deprecated. Use ip and ss on Linux. (On FreeBSD, ifconfig is still the right call.)

Check your IPs and interfaces

ip addr           # or `ip a`
ip -br a          # compact one-line-per-interface view
ip link           # interfaces, no addresses

You're looking for a line like:

2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
    inet 192.168.1.50/24 ...

UP = the interface is on. LOWER_UP = a cable is plugged in / the Wi-Fi is associated. inet 192.168.1.50/24 = the IPv4 address and a "/24" netmask (meaning 192.168.1.x is the local subnet).

Check your route to the world

ip route
# default via 192.168.1.1 dev enp3s0 ...

The default route is the gateway — the router everything not on your subnet gets sent to. If there's no default, your machine has no way to reach the internet.

Check DNS

cat /etc/resolv.conf
# nameserver 1.1.1.1
# nameserver 9.9.9.9

These are the IP addresses your machine asks when it needs to look up a hostname. 1.1.1.1 is Cloudflare's; 9.9.9.9 is Quad9; your router's IP is also common.

Heads-up: on most modern distros, /etc/resolv.conf is auto-generated by NetworkManager or systemd-resolved. Editing it by hand may be overwritten on the next reboot. Use the right tool (see below) if you want changes to stick.

What's listening, what's connecting

ss -tulpn         # TCP + UDP, listening sockets, with process names
ss -tn state established       # currently-established TCP connections
ss -s             # quick summary

Flag soup:

  • -t TCP, -u UDP, -l listening, -p show process, -n numeric (no name resolution).

The result tells you "what services are exposed on this machine and to which addresses." A line like LISTEN 0 128 0.0.0.0:22 means SSH is listening on all interfaces.

Test the basics, in order

ping -c 4 192.168.1.1           # can I reach my router?
ping -c 4 1.1.1.1               # can I reach the internet by IP?
ping -c 4 example.com           # can I resolve and reach by name?

If ping by IP works but ping by name doesn't, DNS is broken — fix /etc/resolv.conf or restart your resolver.

dig example.com                 # nicer DNS query
host example.com                # shortest DNS query

Two ways Linux distros manage networking

Same kernel, two competing tools. Both exist on most distros, only one is in charge.

NetworkManager (most desktops)

Used by Mint, Ubuntu desktops, Fedora, Manjaro KDE/GNOME, etc. Has a graphical applet in the taskbar plus two CLI front-ends:

nmtui                          # friendly menu
nmcli device                   # list interfaces
nmcli con show                 # configured connections
nmcli con up "wifi-name"       # connect
nmcli dev wifi list            # scan
nmcli dev wifi connect "ssid" password "pass"

NetworkManager writes connection profiles under /etc/NetworkManager/system-connections/.

systemd-networkd (servers, some minimal setups)

Used by Debian server installs, Arch by default, many container images. Config lives in /etc/systemd/network/ as small .network files:

# /etc/systemd/network/20-wired.network
[Match]
Name=enp3s0

[Network]
DHCP=yes

Then:

sudo systemctl enable --now systemd-networkd
sudo systemctl enable --now systemd-resolved
networkctl                     # status of every interface

If systemd-resolved is in charge, /etc/resolv.conf is a symlink it manages. Set DNS servers in the .network file or via resolvectl dns enp3s0 1.1.1.1.

Pick one. Running both fighting over the same interface is a guaranteed bad day.

Open / close a port at the firewall

The firewall is a separate layer. See the distro-specific guides (nftables on Trixie, pf in one config) for ruleset basics, plus:

sudo ufw allow 22/tcp          # ufw (Debian/Mint/Ubuntu convenience wrapper)
sudo firewall-cmd --add-port=22/tcp --permanent && sudo firewall-cmd --reload

ufw and firewall-cmd are just friendlier front-ends to nftables.

The diagnostic routine

  1. ip -br a — do I have an address?
  2. ip route — do I have a default gateway?
  3. ping 1.1.1.1 — can I reach the world?
  4. ping example.com — does DNS work?
  5. ss -tulpn — is the service I'm looking for actually listening?
  6. sudo journalctl -u NetworkManager -n 50 (or systemd-networkd) — did the network stack itself complain?

One of those six steps almost always reveals the culprit.

← back to index