How networks work: addresses, ports, DNS

Linux · Practical · 10 min

Network commands only make sense once you know what an address, a port and a name lookup are.

When two computers talk, the data travels in small chunks called packets, each labelled with where it's going, like letters in the post. To deliver them, every machine on a network needs an address.

That address is the IP address: four numbers like 192.168.1.20 (IPv4), or a longer form with colons like fe80::1 (IPv6). A machine connects to networks through network interfaces, such as a cable socket or Wi-Fi, and each one has its own address.

Every machine also has a pretend network interface, lo, with the address 127.0.0.1, known as localhost. Traffic sent there never leaves the machine, so a program reachable only on localhost is invisible to the rest of the network.

Packets for other networks are handed to a gateway: a machine that passes traffic between networks, like a post office forwarding letters. Each machine keeps a routing table, a short list of rules saying where to send packets for which addresses. The rule for everything else, the default route, points at the gateway that leads to the internet.

One machine runs many network programs at once, so an address alone isn't enough. Each program uses a port, a number from 1 to 65535, like a flat number in a building: websites use 443 (and 80), SSH uses 22. A program waiting for connections on a port is said to listen on it. Listening on a port below 1024 needs administrator rights.

Most traffic follows one of two sets of rules. TCP first sets up a connection with a short exchange, the handshake, then makes sure everything arrives complete and in order. UDP just sends packets, with no connection and no guarantees; it's quicker. A program's end of a connection is called a socket.

People use names, not numbers. DNS is the internet's phone book: it turns a name like example.com into an IP address. A machine's own name is its hostname.

Finally, a firewall decides which packets may come in or go out, following rules like "allow port 443 from anywhere".

Example

hostname                      # web1   (this machine's name)
ip -br addr                   # network interfaces and their IP addresses
# lo    UNKNOWN  127.0.0.1/8 ::1/128
# eth0  UP       192.168.1.20/24
ip route                      # default via 192.168.1.1 dev eth0   (the gateway)
getent hosts example.com      # <an IP address>  example.com   (a DNS lookup; the number varies)
cat /etc/resolv.conf          # nameserver ...   (which DNS server is asked)
grep -w 22 /etc/services      # ssh  22/tcp   (well-known port numbers)
head -n 3 /etc/hosts          # names listed by hand, checked before DNS

Remember

  • An IP address finds the machine; a port finds the program on it
  • 127.0.0.1 (localhost) never leaves the machine; the default route leads out
  • DNS turns names into IP addresses; TCP is reliable, UDP is quick

Watch out for

  • Blaming the network when the program simply isn't listening on the port you're trying.

Check yourself

  1. A server runs both a website and SSH. What tells incoming traffic which program it's for?
  2. What does DNS do?

Sign in to answer, see the explanations, and get this lesson back as a quick review later.

Official docs: man7.org/linux/man-pages/man7/ip.7.html