Linux - Linux Network Configuration with ip and ss?

Linux provides modern command-line tools for configuring, inspecting, and troubleshooting network connections. Among the most important are the ip command and the ss command. The ip command is mainly used to manage network interfaces, IP addresses, routes, and related networking components, while ss is used to examine network sockets and active connections.

1. Understanding Linux Network Interfaces

A network interface is the software representation of a network connection available to the operating system. It may represent a physical Ethernet adapter, a wireless adapter, a virtual interface, or a loopback interface.

To display available network interfaces, use:

ip link

A typical output may look like:

1: lo: <LOOPBACK,UP,LOWER_UP>
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP>
3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP>

Here, lo is the loopback interface, while eth0 and wlan0 could represent Ethernet and wireless interfaces.

The loopback interface allows a computer to communicate with itself. Its commonly used address is 127.0.0.1 for IPv4 and ::1 for IPv6.

2. Checking IP Addresses

The ip addr command displays IP addresses assigned to network interfaces.

ip addr

A shorter form is:

ip a

You can also inspect a specific interface:

ip addr show eth0

An interface might have an address such as:

192.168.1.25/24

The /24 represents the network prefix length. In IPv4, /24 normally corresponds to the subnet mask 255.255.255.0.

The address information is important when determining whether a machine is correctly connected to a local network.

3. Bringing an Interface Up or Down

The ip command can change the administrative state of an interface.

To enable an interface:

sudo ip link set eth0 up

To disable it:

sudo ip link set eth0 down

After changing the state, you can verify it with:

ip link show eth0

An interface marked UP is administratively enabled. The LOWER_UP status generally indicates that the underlying link is detected as operational.

These commands are useful when troubleshooting interfaces that appear disabled.

4. Assigning an IP Address

An IP address can be temporarily assigned to an interface using:

sudo ip addr add 192.168.1.50/24 dev eth0

The command tells Linux to assign 192.168.1.50 with a /24 prefix to eth0.

You can verify the assignment using:

ip addr show eth0

To remove the address:

sudo ip addr del 192.168.1.50/24 dev eth0

These changes made directly with the ip command are generally runtime configuration. On many Linux distributions, they are not automatically preserved after a reboot. Permanent configuration is normally managed through the distribution's network-management system.

5. Understanding Routing

An IP address identifies a host interface, but Linux also needs to know where packets should be sent. This information is maintained in the routing table.

To display the routing table:

ip route

Example:

default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.50

The default route is used when there is no more specific route for a destination.

In this example:

default via 192.168.1.1 dev eth0

means that traffic destined for networks not otherwise listed should be sent through the gateway 192.168.1.1 using eth0.

The second route indicates that the local 192.168.1.0/24 network is directly reachable through eth0.

6. Adding and Removing Routes

Linux allows administrators to add routes manually.

For example:

sudo ip route add 10.10.20.0/24 via 192.168.1.1

This tells Linux to reach the 10.10.20.0/24 network through the gateway 192.168.1.1.

A route can be removed with:

sudo ip route del 10.10.20.0/24

You can also specify an interface directly when appropriate:

sudo ip route add 10.10.30.0/24 dev eth0

Manual routing is particularly useful on servers, test systems, routers, and troubleshooting environments.

7. Inspecting a Specific Route

Instead of examining the entire routing table, Linux can determine how it would route traffic to a particular destination.

For example:

ip route get 8.8.8.8

The output can indicate the selected interface, source address, gateway, and other routing information.

This is useful when a system has multiple network interfaces and you need to determine which path Linux will choose for outgoing traffic.

8. Understanding ss

While ip primarily examines network interfaces and routing, ss focuses on network sockets.

A socket represents one endpoint of network communication. Applications such as web servers, SSH servers, databases, and mail servers create sockets to communicate over a network.

To display active sockets:

ss

For a more useful overview:

ss -tuln

The options mean:

• -t displays TCP sockets.

• -u displays UDP sockets.

• -l displays listening sockets.

• -n displays numerical addresses and port numbers instead of resolving names.

A result might contain:

Netid  State   Local Address:Port
tcp    LISTEN  0.0.0.0:22
tcp    LISTEN  0.0.0.0:80

This indicates that services are listening on TCP ports 22 and 80.

9. Understanding Listening Ports

A listening socket means that an application is waiting for incoming connections.

For example:

ss -ltn

shows listening TCP sockets.

If you see:

LISTEN 0 128 0.0.0.0:22

port 22 is associated with an SSH service in the common configuration.

Similarly, a web server may listen on port 80 for HTTP traffic or port 443 for HTTPS traffic.

Listening-port information is valuable when troubleshooting services that cannot be reached from another machine.

10. Finding Which Process Uses a Port

The ss command can also provide process information:

sudo ss -tulpn

The -p option displays the process associated with a socket when sufficient privileges are available.

For example, the output may identify a process such as:

users:(("sshd",pid=1234,fd=3))

This helps administrators determine which application has opened a particular port.

This is especially useful when two services appear to be competing for the same port.

11. Examining Established TCP Connections

To display established TCP connections:

ss -tn state established

An established connection indicates that communication between two TCP endpoints has been successfully established.

For example:

ESTAB 0 0 192.168.1.50:22 192.168.1.20:54321

Here, the local system is communicating through port 22, while the remote system is using an ephemeral port such as 54321.

This information can help identify active client connections to a server.

12. Inspecting UDP Sockets

UDP does not establish connections in the same way as TCP. Nevertheless, applications can create UDP sockets that can be inspected with:

ss -uln

For both TCP and UDP:

ss -tun

UDP is commonly used by services such as DNS and various real-time communication applications.

13. Filtering ss Output

Large servers can have hundreds or thousands of sockets. ss provides filtering capabilities to make the output easier to understand.

For example:

ss -tn sport = :443

can be used to examine TCP sockets associated with local port 443.

You can also inspect connections involving a particular destination:

ss -tn dst 192.168.1.20

Filtering is particularly helpful during network troubleshooting because it allows administrators to focus on a specific service, address, or connection state.

14. Using ip and `ss Together

The real strength of these tools becomes apparent when they are used together.

Suppose a web server cannot be reached from another computer. You can first inspect the interface:

ip addr

Then examine the routing configuration:

ip route

Next, check whether the web server is actually listening:

sudo ss -ltnp

If port 443 is not listening, the problem may be related to the web server application. If the service is listening but the interface or routing configuration is incorrect, the problem may be at the network layer.

This approach helps separate problems involving the network interface, IP configuration, routing, and application sockets.

15. Checking the Network Path

The ip command can also help determine how Linux selects a route to a destination:

ip route get 192.168.1.100

For more detailed network troubleshooting, other utilities such as ping, traceroute, and tracepath can complement ip and ss.

For example:

ping 192.168.1.1

can test basic IP connectivity to a gateway.

However, successful pinging does not necessarily mean that a particular application is working. A server can respond to ICMP traffic while its TCP service remains unavailable. That is why socket inspection with ss is useful.

16. IPv6 Network Configuration

Linux supports IPv6 alongside IPv4.

IPv6 addresses can be viewed with:

ip -6 addr

IPv6 routes can be viewed with:

ip -6 route

IPv6 sockets can be inspected with:

ss -6

Administrators working in modern network environments should understand both IPv4 and IPv6 because many systems operate in dual-stack configurations.

17. Temporary Versus Permanent Configuration

One important distinction is between runtime configuration and persistent configuration.

Commands such as:

sudo ip addr add ...

and:

sudo ip route add ...

modify the currently running networking configuration. Depending on the Linux distribution and network-management framework, these changes may disappear after reboot or when the relevant network connection is restarted.

Permanent configuration is usually managed through tools such as NetworkManager, systemd-networkd, Netplan, or distribution-specific network configuration files.

Therefore, ip is particularly useful for immediate configuration, testing, and troubleshooting, while persistent network configuration should be handled through the appropriate network-management system.

18. Practical Troubleshooting Workflow

A useful Linux network troubleshooting sequence is:

ip link

Check whether the interface exists and is enabled.

ip addr

Check whether the interface has the expected IP address.

ip route

Check whether appropriate routes and a default gateway exist.

ip route get <destination>

Determine which route Linux will use for a particular destination.

ss -tuln

Check whether expected TCP and UDP services are listening.

ss -tun

Inspect active network connections.

This workflow allows an administrator to move logically from the network interface to IP addressing, routing, and finally application-level sockets.

Conclusion

The ip and ss commands are essential tools for modern Linux network administration. The ip command provides detailed control and visibility over interfaces, IP addresses, routes, and network configuration, while ss provides visibility into TCP and UDP sockets, listening services, and active connections.

Understanding both commands enables administrators to diagnose common problems such as missing IP addresses, inactive interfaces, incorrect routes, unavailable services, unexpected connections, and ports that are not listening. Together, they provide a powerful command-line approach to understanding what is happening inside a Linux system's network stack.