Introduction

Advanced networking begins when a host has several addresses, interfaces, gateways, or security boundaries. Effective diagnosis combines the kernel's routing decision with socket and packet evidence.

What you should be able to do after this lesson:

Configure and inspect a multi-homed host.
Understand route selection and policy routing.
Inspect listening and established sockets.
Test TCP and UDP services.
Capture and filter traffic.
Use scanning tools responsibly.

Big Idea: Local State and Wire Evidence Answer Different Questions

Routing tables predict what the kernel should do. Socket tables show what local processes are doing. A packet capture shows what actually crossed an observation point. Strong network diagnosis uses all three:

route decision -> local socket state -> packets on the interface

When those views disagree, the difference usually identifies the failed layer.

Multi-Homed Systems

A multi-homed host has more than one active network connection. Multiple default routes can create asymmetric paths, where requests and replies use different interfaces.

ip addr show
ip route show table all
ip rule show
ip route get 203.0.113.10 from 192.0.2.10

Metrics choose between otherwise comparable routes. Policy routing uses rules to select alternate routing tables based on source, mark, or other fields.

sudo ip route add default via 198.51.100.1 table 100
sudo ip rule add from 198.51.100.20/32 table 100

Sockets and Owners

ss -tulpn
ss -tan state established
lsof -iTCP -sTCP:LISTEN

Interpret carefully:

a listening socket proves a process is bound locally
binding to 127.0.0.1 does not accept remote connections
a firewall may still block a service bound to all addresses
an established connection confirms a completed transport handshake

Reachability Tests

ping -c 3 <host>
nc -vz <host> 443
nc -u -vz <host> 53

ping tests ICMP reachability, not a specific application. nc can test whether a TCP connection opens and can exchange raw data. UDP tests are less conclusive because there is no handshake.

Packet Capture

sudo tcpdump -ni any host 192.0.2.20
sudo tcpdump -ni eth0 'tcp port 443 and (tcp[tcpflags] & tcp-syn != 0)'

A capture can answer:

Did the request leave?
Did a reply return?
Was the reply sent on another interface?
Is a TCP reset or ICMP error present?

Capture only required traffic and protect files that may contain sensitive payloads.

Network Scanning

nmap -sT -p 22,80,443 <host>

Use nmap only on systems you are authorized to test. A scan result describes the path from the scanner, not necessarily local bind state.

Authentication Awareness

Wireless and wired network access may involve WPA, 802.1X, supplicants, and certificate or credential configuration. When link state is up but no network access appears, inspect authentication logs before changing IP routes.

wpa_supplicant can manage WPA authentication, while 802.1X may use EAP credentials or certificates on wired and wireless links. A link can report carrier before authentication grants normal traffic, so physical state alone does not prove network admission.

Guided Practice: Prove a TCP Connection

On a lab host, choose a service you are authorized to inspect. In separate terminals run:

ss -ltnp
sudo tcpdump -ni any 'tcp port <port>'
nc -vz 127.0.0.1 <port>

Correlate the listener with the handshake:

SYN leaves the client.
SYN,ACK returns from an accepting listener.
ACK completes the handshake.
RST usually means the destination actively rejected the connection.
repeated SYN packets without a reply suggest loss or filtering.

Then run the same test from another host. If local access works and remote access fails, compare bind address, route, host firewall, and network firewall rather than changing the application immediately.

For a multi-homed system, run ip route get <destination> from <source> and verify that the capture appears on the predicted interface.

Troubleshooting Scenario

A service listens on 0.0.0.0:443, the firewall permits it, and clients send SYN packets. The server replies through a second default gateway, so the client never accepts the asymmetric return path.

Use ip route get with the client source, inspect policy rules and route metrics, and capture on both interfaces. Add an appropriate source-based rule or correct the gateway design. Restarting the web service cannot change the kernel's return route.

Exam Focus

Know ip, ifconfig, route, arp, ss, netstat, and lsof perspectives.
Use ping, nc, tcpdump, and nmap for increasingly specific tests.
Understand multi-homing, metrics, policy routing, and asymmetric paths.
Separate network authentication from address and route configuration.

Recap

Route lookup must account for source, table, metric, and policy rules.
Socket tools show local state; packet captures show what actually crossed an interface.
Service tests are more specific than ping.
Always interpret results from the observation point where they were collected.

205.2 Advanced Network Configuration