Linux Networking Basics: IP, Ports & Protocols - Complete 2026 Guide

Linux Networking Basics: IP, Ports & Protocols - Complete 2026 Guide

Understanding linux networking is fundamental for anyone pursuing a career in cybersecurity, penetration testing, or ethical hacking. Whether you're running Kali Linux or any other Linux distribution, mastering network concepts, IP addressing, ports, and protocols is essential for conducting effective security assessments and network reconnaissance.

In this comprehensive guide, we'll explore the core networking concepts every pentester needs to know. By the end of this tutorial, you'll understand how networks function at a fundamental level and be equipped with practical commands to configure, troubleshoot, and analyze network connections in your Kali Linux environment.

What is Linux Networking?

Linux networking refers to the collection of tools, protocols, and configurations that enable Linux systems to communicate with other devices over local and wide area networks. Unlike Windows, Linux provides powerful command-line utilities that give you granular control over network interfaces, routing tables, firewall rules, and network services.

For penetration testers, understanding linux networking is crucial because:

• Network reconnaissance requires knowledge of how IP addresses, ports, and protocols work
• Exploitation often involves manipulating network traffic and connections
• Post-exploitation activities like lateral movement depend on network awareness
• Reporting requires documenting network architecture and vulnerabilities

As you progress through the Kali Linux Configuration Essential Settings & Updates 2026 Guide, you'll find that network configuration is one of the first critical steps in setting up your penetration testing environment.

Understanding IP Addresses: IPv4 and IPv6

IPv4 Addresses

Internet Protocol version 4 (IPv4) remains the most widely used addressing system. An IPv4 address consists of four octets (8-bit numbers) separated by dots, ranging from 0 to 255.

Example: 192.168.1.100

IPv4 Address Classes

IPv6 Addresses

IPv6 was developed to address the IPv4 address exhaustion problem. An IPv6 address is 128 bits long, written as eight groups of four hexadecimal digits separated by colons.

Example: 2001:0db8:85a3:0000:0000:8a2e:0370:7334

IPv6 addresses can be shortened by:

• Omitting leading zeros: 2001:db8:85a3:0:0:8a2e:370:7334
• Replacing consecutive zeros with ::: 2001:db8:85a3::8a2e:370:7334

CIDR Notation

Classless Inter-Domain Routing (CIDR) notation expresses IP addresses with their subnet mask using a slash followed by the number of network bits.

Examples:

• 192.168.1.0/24 = 256 addresses (last octet variable)
• 10.0.0.0/8 = 16,777,216 addresses
• 172.16.0.0/16 = 65,536 addresses

Understanding CIDR is essential when using tools like Nmap for network scanning.

Public vs Private IP Addresses

Private IP Address Ranges

These addresses are reserved for internal networks and are not routable on the public internet:

• 10.0.0.0 - 10.255.255.255 (10.0.0.0/8) - Class A
• 172.16.0.0 - 172.31.255.255 (172.16.0.0/12) - Class B
• 192.168.0.0 - 192.168.255.255 (192.168.0.0/16) - Class C
• 127.0.0.0 - 127.255.255.255 (127.0.0.0/8) - Loopback

Public IP Addresses

Public IP addresses are globally unique and routable on the internet. Your ISP assigns these addresses, and they're used to identify devices on the public network.

Key Differences:

Network Address Translation (NAT)

NAT allows multiple devices with private IPs to share a single public IP address. This is crucial for penetration testing because:

• You need to understand how traffic flows through NAT devices
• Port forwarding rules can expose internal services
• NAT can complicate reverse shell connections during exploitation

Network Interfaces in Linux

Linux identifies network interfaces with specific naming conventions. Understanding these interfaces is fundamental to linux networking.

Common Interface Names

Legacy Naming (still used in some systems)

• eth0, eth1, eth2... - Ethernet interfaces
• wlan0, wlan1... - Wireless interfaces
• lo - Loopback interface (127.0.0.1)
• ppp0 - Point-to-Point Protocol connections

Predictable Network Interface Names

Modern Linux distributions use predictable naming:

• enp0s3 - Ethernet (en), PCI bus (p), slot 0 (0), function 3 (s3)
• eno1 - Ethernet, onboard device 1
• wlp3s0 - Wireless (wl), PCI bus 3, slot 0
• lo - Loopback (unchanged)

Loopback Interface

The loopback interface (lo) with address 127.0.0.1 (or ::1 for IPv6) allows a system to communicate with itself. This is critical for:

• Testing network applications locally
• Inter-process communication
• Troubleshooting network stack issues

As covered in the 50 Essential Linux Commands for Cybersecurity and Ethical Hacking 2026 Guide, understanding network interfaces helps you navigate your system more effectively.

Viewing Network Configuration

Linux provides several commands to view and manage network configuration. Let's explore the most important tools for linux networking.

Using ip Command (Modern Method)

The ip command is the modern replacement for older tools like ifconfig. It's part of the iproute2 package.

View All Network Interfaces

ip addr show
# Or shorthand
ip a

Sample Output:

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 08:00:27:3f:4a:5b brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.100/24 brd 192.168.1.255 scope global eth0
    inet6 fe80::a00:27ff:fe3f:4a5b/64 scope link

View Specific Interface

ip addr show eth0
# Or
ip a s eth0

View Routing Table

ip route show
# Or shorthand
ip r

Sample Output:

default via 192.168.1.1 dev eth0 proto dhcp metric 100
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100 metric 100

This shows:

• Default gateway: 192.168.1.1
• Local network: 192.168.1.0/24
• Interface: eth0

View Network Statistics

ip -s link

This displays packet statistics including transmitted/received packets, errors, and dropped packets.

Using ifconfig (Legacy Method)

While deprecated, ifconfig is still available and used in many scripts:

ifconfig
# View specific interface
ifconfig eth0

Note: On minimal installations, you may need to install net-tools:

sudo apt update && sudo apt install net-tools

Viewing Network Connections

Check Link Status

ip link show

This shows whether interfaces are UP or DOWN, along with MAC addresses.

Display Only IPv4 Addresses

ip -4 addr

Display Only IPv6 Addresses

ip -6 addr

Configuring a Static IP Address

While DHCP automatically assigns IP addresses, penetration testing often requires static IP configuration for consistency and network control.

Method 1: Using ip Command (Temporary)

These changes are lost after reboot:

# Bring interface down
sudo ip link set eth0 down

# Assign static IP
sudo ip addr add 192.168.1.150/24 dev eth0

# Set default gateway
sudo ip route add default via 192.168.1.1

# Bring interface up
sudo ip link set eth0 up

Method 2: NetworkManager (Desktop Systems)

For systems with NetworkManager:

# Using nmcli (NetworkManager CLI)
nmcli connection show

# Configure static IP
sudo nmcli connection modify "Wired connection 1" \
  ipv4.method manual \
  ipv4.addresses 192.168.1.150/24 \
  ipv4.gateway 192.168.1.1 \
  ipv4.dns "8.8.8.8 8.8.4.4"

# Restart connection
sudo nmcli connection down "Wired connection 1"
sudo nmcli connection up "Wired connection 1"

Method 3: Netplan (Ubuntu/Debian Modern)

Edit /etc/netplan/01-netcfg.yaml:

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      dhcp4: no
      addresses:
        - 192.168.1.150/24
      gateway4: 192.168.1.1
      nameservers:
        addresses:
          - 8.8.8.8
          - 8.8.4.4

Apply configuration:

sudo netplan apply

Method 4: /etc/network/interfaces (Debian/Kali)

Edit /etc/network/interfaces:

auto eth0
iface eth0 inet static
    address 192.168.1.150
    netmask 255.255.255.0
    gateway 192.168.1.1
    dns-nameservers 8.8.8.8 8.8.4.4

Restart networking:

sudo systemctl restart networking
# Or
sudo /etc/init.d/networking restart

DNS Configuration in Linux

Domain Name System (DNS) translates human-readable domain names to IP addresses. Proper DNS configuration is essential for linux networking and penetration testing.

The /etc/resolv.conf File

This file contains DNS server information:

cat /etc/resolv.conf

Sample Content:

nameserver 8.8.8.8
nameserver 8.8.4.4
nameserver 192.168.1.1
search localdomain

Key Directives

• nameserver - DNS server IP (up to 3 can be listed)
• search - Domain suffix for hostname lookups
• domain - Local domain name
• options - Various resolver options

Manually Editing DNS Settings

sudo nano /etc/resolv.conf

Add nameservers:

nameserver 1.1.1.1
nameserver 1.0.0.1

Common DNS Servers:

Making DNS Changes Persistent

On systems with NetworkManager, /etc/resolv.conf is often auto-generated. To make permanent changes:

# Prevent automatic overwriting
sudo chattr +i /etc/resolv.conf

# To allow changes again later
sudo chattr -i /etc/resolv.conf

Or configure via NetworkManager:

sudo nmcli connection modify "Wired connection 1" ipv4.dns "1.1.1.1 1.0.0.1"
sudo nmcli connection down "Wired connection 1" && nmcli connection up "Wired connection 1"

Testing DNS Resolution

# Simple lookup
nslookup kali.org

# Detailed DNS query
dig kali.org

# Query specific DNS server
dig @8.8.8.8 kali.org

# Reverse DNS lookup
dig -x 192.168.1.1

Understanding Ports and Services

What are Ports?

Ports are virtual endpoints for network communication, ranging from 0 to 65535. They allow multiple services to run on a single IP address.

Port Ranges

• Well-Known Ports (0-1023) - Reserved for system services (requires root)
• Registered Ports (1024-49151) - Assigned to user processes
• Dynamic/Private Ports (49152-65535) - Temporary ports for client connections

The /etc/services File

This file maps service names to port numbers:

cat /etc/services | grep -E "^(ssh|http|https)"

Sample Output:

http     80/tcp   www     # WorldWideWeb HTTP
https    443/tcp          # http protocol over TLS/SSL
ssh      22/tcp           # SSH Remote Login Protocol

Common Ports Reference Table

Every penetration tester must memorize these essential ports:

Knowing these ports is crucial when analyzing Nmap scan results and conducting vulnerability assessments.

Viewing Active Ports

Several commands show which ports are listening on your system:

Using ss (Socket Statistics - Modern)

# Show all listening TCP ports
sudo ss -tlnp

# Show all listening UDP ports
sudo ss -ulnp

# Show all connections
sudo ss -tunap

Flags Explained:

• -t = TCP
• -u = UDP
• -l = Listening sockets
• -n = Numeric (don't resolve names)
• -p = Show process
• -a = All sockets

Using netstat (Legacy but Common)

# Show all listening ports with process info
sudo netstat -tulnp

# Show active connections
netstat -tunap

# Show routing table
netstat -r

Using lsof

# List all network connections
sudo lsof -i

# List specific port
sudo lsof -i :80

# List by protocol
sudo lsof -i tcp
sudo lsof -i udp

TCP vs UDP: Key Protocol Differences

Understanding the differences between Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) is fundamental to linux networking and penetration testing.

TCP (Transmission Control Protocol)

Characteristics:

• Connection-oriented - Establishes connection via three-way handshake
• Reliable - Guarantees packet delivery and order
• Error checking - Retransmits lost packets
• Flow control - Prevents overwhelming receivers
• Slower - Due to overhead

TCP Three-Way Handshake:

1. SYN - Client sends synchronize packet
2. SYN-ACK - Server acknowledges and sends its own SYN
3. ACK - Client acknowledges server's SYN

Use Cases:

• Web browsing (HTTP/HTTPS)
• Email (SMTP, POP3, IMAP)
• File transfers (FTP, SSH)
• Remote administration (SSH, RDP)

UDP (User Datagram Protocol)

Characteristics:

• Connectionless - No handshake or session
• Unreliable - No delivery guarantee
• No error checking - Sender doesn't know if packets arrive
• No flow control - Sends at maximum rate
• Faster - Minimal overhead

Use Cases:

• DNS queries
• Video streaming
• Online gaming
• VoIP calls
• DHCP
• SNMP

Comparison Table

Why This Matters for Pentesting

Understanding TCP vs UDP is critical when:

• Port scanning - Different scan techniques for each protocol
• Firewall evasion - UDP packets may bypass TCP-focused filters
• Packet crafting - Creating custom packets requires protocol knowledge
• Traffic analysis - Identifying suspicious patterns
• Exploit development - Protocol-specific vulnerabilities

When following a structured Pentest Methodology: The Complete Guide for 2026, understanding these protocols helps in reconnaissance and exploitation phases.

Network Troubleshooting Tools

Mastering these linux networking troubleshooting tools is essential for diagnosing connectivity issues and conducting reconnaissance.

1. ping - Test Connectivity

Tests reachability and measures round-trip time:

# Basic ping
ping google.com

# Send specific number of packets
ping -c 4 192.168.1.1

# Ping with larger packet size
ping -s 1000 192.168.1.1

# Set interval (seconds)
ping -i 2 kali.org

# Ping without DNS resolution
ping -n 8.8.8.8

Understanding Output:

PING google.com (142.250.185.46) 56(84) bytes of data.
64 bytes from 142.250.185.46: icmp_seq=1 ttl=117 time=12.3 ms

• ttl (Time To Live) - Hops remaining (decreased by each router)
• time - Round-trip time in milliseconds
• icmp_seq - Sequence number

2. traceroute - Trace Network Path

Shows the route packets take to reach a destination:

# Basic traceroute
traceroute google.com

# Use UDP (default)
traceroute -U google.com

# Use ICMP
traceroute -I google.com

# Use TCP
traceroute -T -p 443 google.com

# Set max hops
traceroute -m 20 google.com

Sample Output:

traceroute to google.com (142.250.185.46), 30 hops max
 1  192.168.1.1 (192.168.1.1)  1.234 ms
 2  10.0.0.1 (10.0.0.1)  8.567 ms
 3  * * *
 4  142.250.185.46 (142.250.185.46)  12.345 ms

Asterisks (*) indicate timeouts or filtered responses.

3. dig - DNS Lookup Tool

Powerful DNS interrogation tool:

# Basic query
dig kali.org

# Query specific record type
dig kali.org A      # IPv4 address
dig kali.org AAAA   # IPv6 address
dig kali.org MX     # Mail servers
dig kali.org NS     # Name servers
dig kali.org TXT    # Text records
dig kali.org SOA    # Start of Authority

# Query specific DNS server
dig @8.8.8.8 kali.org

# Short answer only
dig +short kali.org

# Reverse DNS lookup
dig -x 8.8.8.8

# Trace DNS delegation path
dig +trace kali.org

4. nslookup - DNS Query Tool

Simpler DNS lookup utility:

# Basic lookup
nslookup kali.org

# Query specific server
nslookup kali.org 8.8.8.8

# Interactive mode
nslookup
> server 1.1.1.1
> set type=MX
> kali.org
> exit

5. host - Simple DNS Lookup

# Basic lookup
host kali.org

# All record types
host -a kali.org

# Specific type
host -t MX kali.org

# Reverse lookup
host 8.8.8.8

6. ss - Socket Statistics

# All TCP connections
ss -ta

# All UDP connections
ss -ua

# Listening sockets only
ss -tl

# Show process information
ss -tlnp

# Display summary statistics
ss -s

# Filter by state
ss state established
ss state listening

7. netstat - Network Statistics

# All connections
netstat -a

# Listening ports
netstat -l

# Routing table
netstat -r

# Interface statistics
netstat -i

# Protocol statistics
netstat -s

# Continuous monitoring
netstat -c

8. ip - Multi-Purpose Network Tool

# Show neighbors (ARP table)
ip neighbor show

# Show routing table
ip route show

# Monitor real-time changes
ip monitor

# Get route to destination
ip route get 8.8.8.8

9. tcpdump - Packet Capture

Capture and analyze network traffic:

# Capture on specific interface
sudo tcpdump -i eth0

# Capture specific host
sudo tcpdump host 192.168.1.100

# Capture specific port
sudo tcpdump port 80

# Capture and save to file
sudo tcpdump -i eth0 -w capture.pcap

# Read from file
tcpdump -r capture.pcap

# Capture HTTP traffic
sudo tcpdump -i eth0 'tcp port 80'

10. nmap - Network Scanner

While detailed in our Nmap Cheat Sheet, basic usage:

# Ping scan (discover hosts)
sudo nmap -sn 192.168.1.0/24

# Port scan
sudo nmap 192.168.1.100

# Service detection
sudo nmap -sV 192.168.1.100

# OS detection
sudo nmap -O 192.168.1.100

Firewall Basics in Linux

Firewalls control incoming and outgoing network traffic based on predetermined security rules. Understanding linux networking means understanding firewall configuration.

iptables - Legacy Firewall

iptables is the traditional Linux firewall using netfilter kernel module.

Basic iptables Concepts

Tables:

• filter - Default table for packet filtering (INPUT, FORWARD, OUTPUT)
• nat - Network Address Translation
• mangle - Packet alteration
• raw - Connection tracking exemptions

Chains:

• INPUT - Incoming packets destined for local system
• OUTPUT - Outgoing packets from local system
• FORWARD - Packets routed through the system

Common iptables Commands

# List all rules
sudo iptables -L -v -n

# List rules with line numbers
sudo iptables -L --line-numbers

# Allow incoming SSH
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow incoming HTTP/HTTPS
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# Allow established connections
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Drop all other incoming
sudo iptables -A INPUT -j DROP

# Delete specific rule (by number)
sudo iptables -D INPUT 3

# Flush all rules
sudo iptables -F

# Save rules (Debian/Ubuntu)
sudo iptables-save > /etc/iptables/rules.v4

# Restore rules
sudo iptables-restore < /etc/iptables/rules.v4

Block Specific IP

sudo iptables -A INPUT -s 192.168.1.50 -j DROP

Allow Traffic from Specific Network

sudo iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT

UFW - Uncomplicated Firewall

UFW provides a user-friendly interface to iptables, making firewall management much simpler.

Basic UFW Commands

# Install UFW
sudo apt install ufw

# Enable UFW
sudo ufw enable

# Disable UFW
sudo ufw disable

# Check status
sudo ufw status
sudo ufw status verbose
sudo ufw status numbered

# Default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

Allow/Deny Rules

# Allow specific port
sudo ufw allow 22
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Allow service by name
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https

# Allow port range
sudo ufw allow 6000:6007/tcp

# Allow from specific IP
sudo ufw allow from 192.168.1.100

# Allow from subnet
sudo ufw allow from 192.168.1.0/24

# Allow specific IP to specific port
sudo ufw allow from 192.168.1.100 to any port 22

# Deny traffic
sudo ufw deny 23
sudo ufw deny from 192.168.1.50

Delete Rules

# Delete by rule specification
sudo ufw delete allow 80

# Delete by rule number
sudo ufw status numbered
sudo ufw delete 2

Advanced UFW

# Enable logging
sudo ufw logging on
sudo ufw logging medium  # low, medium, high, full

# Reset to defaults
sudo ufw reset

# Allow specific application
sudo ufw app list
sudo ufw allow "Apache Full"

nftables - Modern Firewall

nftables is the modern replacement for iptables, offering better performance and syntax.

# List all rules
sudo nft list ruleset

# Add simple rule
sudo nft add rule ip filter input tcp dport 22 accept

# Save configuration
sudo nft list ruleset > /etc/nftables.conf

VPN and Proxy Concepts for Penetration Testing

Virtual Private Networks (VPNs) and proxies are essential for maintaining anonymity and bypassing restrictions during penetration testing engagements.

VPN (Virtual Private Network)

A VPN creates an encrypted tunnel between your device and a VPN server, routing all traffic through that server.

Benefits for Pentesting:

• Anonymity - Hides your real IP address
• Encryption - Protects data in transit
• Bypass restrictions - Access geo-restricted resources
• Secure communication - Essential when using public WiFi

OpenVPN in Kali Linux

# Connect to VPN
sudo openvpn config.ovpn

# Run in background
sudo openvpn --config config.ovpn --daemon

# Verify VPN connection
ip addr show tun0
ip route | grep tun0

# Check your public IP
curl ifconfig.me

Common VPN Issues

DNS Leaks:

# Check for DNS leaks
dig +short myip.opendns.com @resolver1.opendns.com

# Force DNS through VPN
sudo nano /etc/resolv.conf
# Add VPN DNS servers

Kill Switch:

Prevent traffic if VPN disconnects:

sudo ufw default deny outgoing
sudo ufw allow out on tun0
sudo ufw enable

Proxy Servers

Proxies act as intermediaries between your system and the internet, forwarding requests on your behalf.

Proxy Types

HTTP/HTTPS Proxy:

• Only handles web traffic
• Can inspect/modify HTTP requests
• Common in corporate environments

SOCKS Proxy:

• Supports any protocol (TCP/UDP)
• More versatile than HTTP proxies
• SOCKS5 supports authentication

Transparent Proxy:

• Intercepts traffic without client configuration
• Often used for content filtering

Using Proxychains

ProxyChains forces TCP connections through proxy servers:

# Install proxychains
sudo apt install proxychains

# Configure
sudo nano /etc/proxychains.conf

Sample Configuration:

# Dynamic chain (tries proxies in order)
dynamic_chain

# Proxy DNS requests
proxy_dns

# Define proxies
[ProxyList]
socks5 127.0.0.1 9050
http 192.168.1.100 8080

Usage:

# Run command through proxy
proxychains firefox
proxychains nmap -sT target.com
proxychains wget http://example.com

SSH Tunneling (SOCKS Proxy)

Create a SOCKS proxy via SSH:

# Create local SOCKS proxy on port 9050
ssh -D 9050 -N user@remote_server

# Use with proxychains
proxychains curl ifconfig.me

Flags explained:

• -D - Dynamic port forwarding (SOCKS)
• -N - Don't execute remote command
• -f - Background the connection

Tor Network

The Onion Router provides anonymity through multiple relay layers:

# Install Tor
sudo apt install tor

# Start Tor service
sudo systemctl start tor
sudo systemctl enable tor

# Verify Tor is running
sudo systemctl status tor

# Tor creates SOCKS proxy on 127.0.0.1:9050

# Use with proxychains
proxychains curl https://check.torproject.org

Tor Browser in Kali

# Launch Tor Browser
torbrowser-launcher

Combining VPN + Proxy + Tor

For maximum anonymity, layer protection:

1. VPN - First layer (ISP only sees VPN traffic)
2. Tor - Second layer (VPN provider doesn't see destination)
3. Proxy - Third layer (Additional obfuscation)

Note: This significantly reduces speed but maximizes anonymity.

When to Use What

Understanding linux networking fundamentals makes working with VPNs and proxies much more effective. For more guidance on professional pentesting workflows, see our official Kali documentation resources.

Best Practices for Linux Networking in Pentesting

As you develop your linux networking skills, keep these best practices in mind:

1. Document Network Configuration

Always document:

• IP addresses assigned
• Network ranges being tested
• Gateway and DNS servers
• VPN/proxy configuration

2. Verify Connectivity Before Testing

# Check interface is up
ip link show

# Verify IP configuration
ip addr show

# Test gateway reachability
ping -c 3 $(ip route | grep default | awk '{print $3}')

# Test DNS resolution
nslookup kali.org

# Test internet connectivity
ping -c 3 8.8.8.8

3. Use Static IPs for Important Systems

Static IPs ensure:

• Consistent access to pentesting tools
• Reliable log correlation
• Easier troubleshooting

4. Understand Your Network Topology

Before testing, diagram:

• Network segments
• Firewall locations
• Gateway/router positions
• Client network architecture

5. Monitor Network Traffic

Use tcpdump or Wireshark to:

• Verify traffic routes correctly
• Debug connectivity issues
• Analyze responses
• Detect anomalies

6. Secure Your Testing System

# Enable firewall
sudo ufw enable

# Allow only necessary ports
sudo ufw allow 22/tcp

# Enable automatic updates
sudo apt install unattended-upgrades

7. Practice on Safe Networks

Before engaging real targets:

• Set up home lab networks
• Use virtual networks (VirtualBox/VMware)
• Practice with intentionally vulnerable machines
• Study network behavior in controlled environments

For more comprehensive guidance on setting up your pentesting environment, refer to the Linux.org documentation.

Conclusion

Mastering linux networking is non-negotiable for anyone serious about penetration testing, cybersecurity, or ethical hacking. In this comprehensive guide, we've covered:

✓ IP addressing - IPv4, IPv6, CIDR notation, public vs private addresses ✓ Network interfaces - eth0, wlan0, lo, and modern naming conventions ✓ Configuration tools - ip, ifconfig, ip route, NetworkManager ✓ Static IP setup - Multiple methods for different distributions ✓ DNS configuration - /etc/resolv.conf management and troubleshooting ✓ Ports and protocols - Essential ports table, TCP vs UDP ✓ Troubleshooting tools - ping, traceroute, dig, nslookup, ss, netstat ✓ Firewall management - iptables and UFW configuration ✓ VPN and proxy - Anonymity and security for pentesting

The commands and concepts covered here form the foundation of network reconnaissance, exploitation, and post-exploitation activities. Whether you're following the full 50 Essential Linux Commands or diving into Nmap scanning techniques, solid networking knowledge accelerates your progress.

As you continue your journey through Kali Linux and penetration testing, these networking fundamentals will be referenced constantly. Practice these commands regularly, experiment with different configurations, and always test in controlled environments before applying to real engagements.

Next in this series, we'll explore process management, system monitoring, and automation—essential skills that build on your networking foundation.

Continue Learning:

• Practice these commands daily
• Set up a home lab network
• Capture and analyze traffic with tcpdump/Wireshark
• Configure VPN connections for anonymous testing
• Study the complete pentesting methodology

Frequently Asked Questions (FAQ)

1. What is the difference between ifconfig and ip command?

ifconfig is the legacy command from the net-tools package, while ip is the modern replacement from iproute2. The ip command offers more features, better performance, and is actively maintained. While ifconfig is still available on most systems for backwards compatibility, it's deprecated and may not be present on minimal installations.

Key differences:

• ip supports newer network features (VLANs, VPNs, tunnels)
• ip has better syntax for complex operations
• ifconfig is limited to basic interface management
• ip is the future-proof choice

For modern linux networking, always use ip commands unless working with legacy scripts that require ifconfig.

2. How do I find my public IP address from the Linux terminal?

There are several methods to find your public IP address from the command line:

# Using curl
curl ifconfig.me
curl icanhazip.com
curl ipinfo.io/ip
curl api.ipify.org

# Using wget
wget -qO- ifconfig.me

# Using dig
dig +short myip.opendns.com @resolver1.opendns.com

# Using host
host myip.opendns.com resolver1.opendns.com

All these methods query external services to return your public-facing IP address. This is especially useful when testing VPN connections—compare the IP before and after connecting to verify the VPN is working.

3. What's the best way to permanently configure DNS servers in Kali Linux?

Permanent DNS configuration depends on your network management system:

Method 1: NetworkManager (most common):

sudo nmcli connection modify "Wired connection 1" ipv4.dns "1.1.1.1 1.0.0.1"
sudo nmcli connection down "Wired connection 1"
sudo nmcli connection up "Wired connection 1"

Method 2: Make /etc/resolv.conf immutable:

sudo nano /etc/resolv.conf  # Edit DNS servers
sudo chattr +i /etc/resolv.conf  # Prevent overwriting

Method 3: Configure in /etc/network/interfaces:

auto eth0
iface eth0 inet static
    address 192.168.1.100
    netmask 255.255.255.0
    gateway 192.168.1.1
    dns-nameservers 1.1.1.1 1.0.0.1

For pentesting, I recommend using Cloudflare DNS (1.1.1.1) or Google DNS (8.8.8.8) for reliability and speed.

4. How can I test if a specific port is open on a remote server?

There are multiple ways to test port connectivity:

Using telnet:

telnet 192.168.1.100 80

If it connects, the port is open. Press Ctrl+] then type quit to exit.

Using nc (netcat):

nc -zv 192.168.1.100 80
nc -zv 192.168.1.100 1-1000  # Scan port range

Using nmap:

nmap -p 80 192.168.1.100
nmap -p 1-65535 192.168.1.100  # Full port scan

Using bash (no tools needed):

timeout 2 bash -c '</dev/tcp/192.168.1.100/80' && echo "Open" || echo "Closed"

Using curl (for HTTP/HTTPS):

curl -I http://192.168.1.100:80
curl -I https://192.168.1.100:443

For comprehensive port scanning during penetration testing, always use nmap as detailed in our Nmap Cheat Sheet.

5. Should I use TCP or UDP for port scanning, and what's the difference?

The choice between TCP and UDP scanning depends on your objectives:

TCP scanning:

• More reliable - Establishes full connection
• Easier to detect - Leaves logs on target systems
• Finds TCP services - Web servers, SSH, FTP, databases
• Default for most scans - nmap defaults to TCP

UDP scanning:

• Slower - Requires timeouts for closed ports
• Less reliable - No acknowledgment mechanism
• Finds UDP services - DNS, DHCP, SNMP, VoIP
• Often overlooked - Many pentesters skip UDP

Best practice for pentesting:

1. Start with TCP scan:

sudo nmap -sS 192.168.1.100  # TCP SYN scan (stealth)

2. Follow with UDP scan on key ports:

sudo nmap -sU --top-ports 100 192.168.1.100

3. Combine for complete coverage:

sudo nmap -sS -sU -p 1-1000 192.168.1.100

UDP scanning takes significantly longer because:

• Open UDP ports may not respond (silent)
• Closed ports may be rate-limited by firewall
• Requires waiting for ICMP "port unreachable" responses

In professional penetration testing, always scan both TCP and UDP to achieve comprehensive coverage, as UDP vulnerabilities are frequently missed but can be critical (such as SNMP misconfigurations or DNS cache poisoning vectors).

Written by Andrax Pentester / Syed Abrar | Last updated: 2026 | Part of Kali Linux Tutorial Series