Networking — Absolute Basics for DevOps

# Quick CIDR calculations
ipcalc 192.168.1.0/24        # detailed breakdown
python3 -c "import ipaddress; print(list(ipaddress.IPv4Network('10.0.1.0/28')))"

# What's listening on which ports?
ss -tlnp             # TCP, listening, numeric, with processes
ss -ulnp             # UDP equivalent

# Who is using port 8080?
ss -tlnp sport = :8080
lsof -i :8080

# Check if remote port is reachable
nc -zv 10.0.0.5 5432          # TCP
nc -zuv 10.0.0.5 53           # UDP
timeout 3 bash -c "echo > /dev/tcp/10.0.0.5/80" && echo "open"

# See connection states
ss -tn state established
ss -tn state time-wait | wc -l    # too many = high traffic or slow close
ss -tn state close-wait           # app not closing connections = memory leak

# Check /etc/hosts first (always checked before DNS)
cat /etc/hosts

# DNS resolution order configured in:
cat /etc/nsswitch.conf | grep hosts

# Which DNS server am I using?
cat /etc/resolv.conf
resolvectl status     # systemd-resolved systems

# Force DNS resolution (bypass OS cache)
dig www.example.com
nslookup www.example.com

# Check TTL on a record
dig www.example.com | grep -A1 "ANSWER"
# ;; ANSWER SECTION:
# www.example.com.   300   IN   A   93.184.216.34
#                    ^^^   TTL in seconds

# Query specific DNS server
dig @8.8.8.8 www.example.com

# Query all record types
dig example.com ANY

# Reverse lookup (IP → hostname)
dig -x 93.184.216.34

# Trace full resolution path
dig +trace www.example.com

# Content negotiation
Accept: application/json
Content-Type: application/json

# Authentication
Authorization: Bearer <token>
Authorization: Basic <base64(user:pass)>

# Caching
Cache-Control: max-age=3600
ETag: "33a64df551425fcc55e4d42a148795d9f25f89d"

# Security
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

# Check a site's certificate
curl -v https://example.com 2>&1 | grep -A5 "Server certificate"

# Detailed cert info
openssl s_client -connect example.com:443 -servername example.com < /dev/null

# Check cert expiry
echo | openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -noout -dates

# Check local cert file
openssl x509 -in cert.pem -noout -text
openssl x509 -in cert.pem -noout -dates

# Full timing breakdown
curl -w "\ndns:%{time_namelookup}s connect:%{time_connect}s tls:%{time_appconnect}s transfer:%{time_starttransfer}s total:%{time_total}s\n" \
  -s -o /dev/null https://example.com

# Follow redirects
curl -L https://example.com

# Custom headers
curl -H "Authorization: Bearer $TOKEN" \
     -H "Content-Type: application/json" \
     https://api.example.com/endpoint

# POST with JSON body
curl -X POST \
     -H "Content-Type: application/json" \
     -d '{"key":"value"}' \
     https://api.example.com/data

# Save response with headers
curl -D headers.txt -o response.body https://example.com

# Test with specific DNS (bypass system DNS)
curl --resolve example.com:443:93.184.216.34 https://example.com

# Verbose (see headers, TLS handshake)
curl -v https://example.com

# Ignore TLS cert errors (for testing ONLY)
curl -k https://self-signed.example.com

# Basic lookup
dig example.com

# Short output (just IP)
dig +short example.com

# Specific record type
dig example.com MX
dig example.com TXT
dig example.com NS

# Query specific DNS server
dig @1.1.1.1 example.com

# Reverse lookup
dig -x 93.184.216.34

# Trace full resolution
dig +trace example.com

# Check all authoritative servers for a domain
dig +nssearch example.com

# ss — modern replacement for netstat
ss -tlnp          # TCP, listening, numeric ports, with processes
ss -tuln          # TCP + UDP, listening
ss -tn dst :443   # connections to port 443
ss -s             # summary statistics

# Filter by state
ss -tn state established
ss -tn state time-wait | wc -l

# netstat (older, still on many systems)
netstat -tlnp
netstat -an | grep ESTABLISHED | wc -l

# Trace the network path to a host
traceroute example.com

# Use TCP (more firewall-friendly)
traceroute -T -p 443 example.com

# mtr — continuous traceroute (better for debugging)
mtr example.com
mtr --report example.com   # run for 10 cycles then print report

# Capture on interface
tcpdump -i eth0

# Filter by host
tcpdump -i eth0 host 10.0.0.5

# Filter by port
tcpdump -i eth0 port 80

# Capture to file for Wireshark analysis
tcpdump -i eth0 -w capture.pcap

# Read capture file
tcpdump -r capture.pcap

# Useful filters
tcpdump -i eth0 'tcp port 443 and host api.example.com'
tcpdump -i eth0 'tcp[tcpflags] & tcp-rst != 0'   # capture RSTs