Networking Stack

The default route is the 0.0.0.0/0 catch-all entry telling the kernel where to send packets that no more specific route matches, normally via a gateway. With no match at all the send fails locally and immediately with ENETUNREACH, "Network is unreachable".

Connection refused means the SYN reached the host and the kernel answered with a TCP RST because no socket was listening on that port. A hang means no answer came back at all, usually a dropped packet, so the client keeps retransmitting the SYN until it gives up.

They use different code paths. dig speaks DNS straight to a nameserver, while applications call getaddrinfo(), which follows the hosts: line of /etc/nsswitch.conf — static files, local modules, then DNS. A source ahead of DNS can answer first.

ip only edits live kernel state, which is never written to disk, so a reboot discards it. Persistence belongs to whichever manager owns the interface — NetworkManager, systemd-networkd, or netplan rendering to one of them — and that manager can also overwrite your address while running.

Netfilter has five hooks. An arriving packet hits PREROUTING first; the routing decision then sends it either to INPUT and a local socket, or to FORWARD and then POSTROUTING on its way out. Locally generated packets take OUTPUT then POSTROUTING.

DNAT rewrites a packet's destination and runs in PREROUTING, before routing. SNAT rewrites the source in POSTROUTING, after routing. MASQUERADE is SNAT that takes the new source address from the outgoing interface automatically, which suits a changing address.

The 10.0.0.0/8 route wins: the kernel matches the longest (most specific) prefix first, and 10.1.2.3 falls inside it. The metric never compares different prefixes — it only breaks ties between routes to the same prefix, where the lowest value wins.

Connections the old server closed are still in TIME_WAIT, so the kernel still has sockets on that local port and refuses a plain bind. Setting SO_REUSEADDR on the listening socket before bind lets the server take the port back despite them.

Kernel names like eth0 were assigned in driver probe order, which could change between boots on multi-NIC machines. systemd-udevd instead derives a stable name from firmware index, PCI slot or bus path, giving eno1, ens3 or enp3s0.

Netfilter tables group rules by the kind of work they do: filter decides whether a packet is accepted or dropped, nat rewrites source or destination addresses and ports, and mangle alters packet fields such as TTL, DSCP or the firewall mark.

127.0.0.53 is systemd-resolved's local stub listener, a caching forwarder running on the host itself. The real upstream servers come from the network configuration or resolved.conf and are shown by resolvectl status. The file is a generated symlink, so edits are overwritten.

UP is the administrative state you requested with ip link set dev X up; LOWER_UP is the driver reporting a live carrier. NO-CARRIER plus state DOWN means the interface is enabled but the physical layer is dead.

A veth is a virtual Ethernet device created in pairs acting like a patch cable: a frame transmitted on one end is received on the other. Attaching one end to a bridge makes it a port on an in-kernel layer-2 switch that learns MACs and forwards between ports.

NEW is a packet starting a flow the kernel has not seen, ESTABLISHED belongs to a flow already seen in both directions, RELATED is a separate flow spawned by an existing one such as an ICMP error, and INVALID fits no tracked flow at all.

By default Linux behaves as a host, not a router: it drops IP packets that are not addressed to it. Setting net.ipv4.ip_forward=1 makes the kernel forward them between interfaces. Persist it in a file under /etc/sysctl.d/ and apply with sysctl --system.

A Unix domain socket skips the TCP/IP stack entirely: no handshake, no ephemeral ports, no TIME_WAIT, lower overhead, and access is controlled by filesystem permissions on the socket file. The cost is that it only works on the same host and leaves a stale file behind after an unclean exit.

Five seconds is the glibc resolver's default per-query timeout, so the host is waiting out a query that never gets answered before falling back. The usual causes are an unreachable first nameserver or one of the parallel A and AAAA queries being dropped.

Encapsulation shrinks the usable payload below the interface MTU, so full-size TCP segments are too big for the path. When the ICMP messages that would report this are filtered, the sender never learns and simply retransmits forever — a path MTU black hole.

The kernel's connection-tracking table is full, so packets that would create a new flow entry are dropped while tracked flows continue. The ceiling is net.netfilter.nf_conntrack_max. Options: raise the limit and hash size, shorten timeouts, or exempt bulk traffic from tracking.

With one routing table there is one default route, so replies to off-subnet clients on the second network leave through the first NIC's gateway. That asymmetry is dropped by reverse-path filtering or by stateful middleboxes. The fix is a second routing table selected by a source-based rule.

It has run out of ephemeral source ports for that destination. Linux picks them from net.ipv4.ip_local_port_range, and each closed connection holds its port in TIME_WAIT for 60 seconds, so a high connect rate exhausts the range. Reusing connections through a keep-alive pool is the durable fix.

A listening socket has two kernel queues: a SYN queue for half-open handshakes and an accept queue of completed connections waiting for the application to call accept(). When the accept queue overflows, Linux drops the client's final handshake packet by default, so the server retransmits its SYN-ACK and the client stalls for seconds.

Unless the application binds a specific address, the source IP is a by-product of the routing decision: the kernel uses the chosen route's preferred-source attribute if it has one, otherwise an address of the egress interface. ip route get <dst> prints the address that would be used.

Not in the C library, which caches nothing between calls. Look at a local caching resolver on the host, an NSS caching daemon, the process's own in-memory address cache, and an already-established connection that was opened to the old address and never closed.

A bond chooses an outgoing member by hashing packet header fields, and a single TCP connection has constant header values, so every packet takes the same link. Aggregation adds capacity across many flows, never within one.

The iptables command translates classic syntax into nf_tables rules, so one ruleset holds everything. The legacy binaries write to the older x_tables subsystem instead; if both are in use, each tool shows only half the rules while the kernel enforces both.

SO_REUSEPORT gives every worker its own accept queue and lets the kernel spread new connections across them by hashing the connection's four-tuple, removing the single-acceptor bottleneck. The tradeoffs are hashed rather than balanced load, and connections lost from a worker's queue when it exits.