Wired Host Networking Configuration

This chapter covers the following exam topics:

• 3. Endpoints and Media Types

  • 3.4. Demonstrate how to set up and check network connectivity on Windows, Linux, Mac, Android, and Apple mobile OS.

    Networking utilities on Windows, Linux, Android, and Apple operating systems; how to run troubleshooting commands; wireless client settings (SSID, authentication, WPA mode)

• 5. Diagnosing Problems

  • 5.3. Run basic diagnostic commands and interpret the results.

    ping, ipconfig/ifconfig/ip, tracert/traceroute, nslookup; recognize how firewalls can influence the result

The previous three chapters discussed how computer networks use addresses and control planes to carry traffic from one host to another. This chapter is a more practical examination of configuring individual hosts to connect to and use an IP network.

We work through

• Verifying the physical interface address.

• Configuring and verifying the IP address.

This chapter also touches on the host routing table. Each section considers a single operating system.

“Do I Know This Already?” Quiz

Take the quiz (either here or use the PTP software) if you want to use the score to help you decide how much time to spend on this chapter. Appendix A, “Answers to the ‘Do I Know This Already?’ Quizzes,” found at the end of the book, includes both the answers and explanations. You can also find answers in the PTP testing software.

Table 4-1 “Do I Know This Already?” Foundation Topics Section-to-Question Mapping

1. What tools can you use to view and manage the IP addresses of interfaces on Windows 11?

1. System Information app, Control Panel, command-line utilities

2. Control Panel, System Information app

3. Settings app, Control Panel, command-line utilities

4. Command-line utilities, Control Panel

2. What Windows 11 application can you use to view the amount of information transmitted and received on an interface? (Choose two.)

1. Control Panel network configuration dialog

2. System Information app interface information

3. Settings app Network & Interface

4. Control Panel Interface Status dialog

3. What is one primary difference between command-line interfaces (CLIs) for configuration and monitoring rather than graphical user interfaces (GUIs) when configuring and monitoring network interfaces?

1. The CLI always provides more information than the GUI.

2. The GUI always uses fewer system resources than the CLI.

3. The CLI is easier to use with scripts and automation tools.

4. The GUI tends to respond more quickly to user commands than a CLI.

4. What tools can you use to view and manage the IP addresses of interfaces on Apple’s OS/X?

1. Control Panel, Finder, command line

2. Settings application, System Information app, command line

3. Control Panel, System Information app, command line

4. Settings application, Finder, command line

5. What are the most common commands used for discovering the IP address in Linux?

1. Powershell and ifconfig

2. ipconfig and ip

3. ifconfig and ip

4. Powershell and ip

6. What kinds of packets do ping applications transmit?

1. User Datagram Protocol (UDP)

2. Transmission Control Protocol (TCP)

3. QUIC

4. Internet Control Message Protocol (ICMP)

7. What kinds of packets do traceroute applications normally transmit? (Choose two.)

1. User Datagram Protocol (UDP)

2. Transmission Control Protocol (TCP)

3. QUIC

4. Internet Control Message Protocol (ICMP)

8. What characteristic of an IP packet does traceroute use to find each hop in a path?

1. Destination address

2. Source address

3. Packet size

4. Time-to-live

9. What does an asterisk (*) in traceroute mean? (Choose two.)

1. The router or host at this hop in the network does not send ICMP responses.

2. The packet passed through a tunnel.

3. The path ends at this point.

4. The network has blocked the ICMP response packet.

10. Why might your public and private IP addresses be different?

1. The host operating system displays your private IP addresses to preserve the user’s privacy.

2. The private IP address is only known to the user, while everyone knows the public IP address.

3. If the network operator runs out of address space, they will sometimes use private IP addresses they own for hosts.

4. Your local network assigns your host a private IP address that is translated to a public IP address for use on the global Internet.

Windows

There are three ways to examine, verify, and configure wire interface information in Windows 11: the Settings app, the Control Panel, and the command line.

The Settings App

To find and verify the network configuration in Windows 11 using the graphical user interface (GUI), open the Settings app and the Network & Internet section. A host may have several interfaces; you must select an individual interface to find its addresses and other information. Figure 4-1 illustrates the Network & internet section for a wired (Ethernet) interface.

Several lines are of interest here:

• IP assignment: Indicates whether the host’s address was assigned manually or through DHCP.

• DNS server assignment: Indicates whether the host’s DNS server address was assigned manually or through DHCP.

• Link speed: Indicates the speed of the physical connection. Chapter 9, “Bandwidth, Delay, and Jitter,” will consider bandwidth in more detail.

• Link-local IPv6 address: Computed as described in Chapter 3, “Routing and Switching.”

• IPv4 address: Indicates the IPv4 address assigned to the Ethernet interface.

• IPv4 DNS servers: DNS servers used to translate (resolve) domain names to IPv4 addresses.

• Physical address (MAC): Indicates the physical address assigned to the interface by the manufacturer.

There are several lines with an Edit button to their right. Clicking the button to the right of IP assignment will allow you to manually assign an IP address rather than depending on a DHCP server. Once you have selected manual, rather than DHCP, assignment, you can change the IPv4 address field.

The Control Panel

A second place you can see the physical and interface addresses on Windows 11 is through the Control Panel. Once you have opened the Control Panel, select Network & Internet, then View Network Status and Tasks. Following this process opens a screen with the label View your basic network information and set up connections at the top.

Once there, select the Ethernet port to see the wired interface information.

Selecting the interface will cause a dialog to appear with some basic information, as shown in Figure 4-2.

This dialog shows some basic information about the interface, including

• IPv4 Connectivity, IPv6 Connectivity: Whether this host has Internet connectivity via IPv4 or IPv6

• Media State: Whether the interface is enabled or disabled

• Duration: How long this interface has been active and connected

• Speed: The speed of the connection

• Bytes Sent: The number of octets of data this host has transmitted on this interface

• Bytes Received: The number of octets of data this host has received on this interface

The Disable option does precisely what it sounds like: disables this interface.

The Diagnose option runs the Windows Network Troubleshooter. The troubleshooter checks the interface’s status and whether the interface has a connection and then tries to ping various addresses. If the interface does not appear connected, the troubleshooter will attempt to reset the interface, release and renew any addresses assigned through DHCP, and take other actions.

The Properties option brings up another dialog, shown in Figure 4-3.

Figure 4-3 shows two different dialogs. On the left is the Properties dialog for the wired information. Clicking some items in the list will only enable the Install and Uninstall options, while others will also enable the Properties option.

If you select Internet Protocol Version 4, the dialog on the figure’s right will pop up. This dialog allows you to configure how the interface obtains an IPv4 address and DNS server information—automatically or manually. You can configure an IPv4 address in the provided space if the manual option is selected.

Returning to the Ethernet Status dialog, selecting the Details option will cause a dialog to pop up containing the current interface physical address, interface address, DHCP lease information, DHCP server, and DNS server. This dialog will also display the subnet mask on some versions of Windows.

The Command Line

A command-line interface (CLI) is interactive: the user types commands and the host returns some response, usually text. Network engineers tend to work with CLIs more than GUIs because

• CLIs tend to respond more quickly.

• CLIs require fewer resources, so they can be implemented in a broader range of devices.

• Text output typically contains a higher density of textual information than GUIs.

• CLIs are more amenable to automation.

Powershell is the best tool on a Windows 11 host to access a command line. Most Windows hosts have Powershell installed, but it is available in the Microsoft Store if not. To display the physical interface from Powershell, use the command getmac /v from the CLI prompt, as shown in Figure 4-4.

Each interface has a single line of output with the following:

• Connection Name: Matches the interface name in GUI

• Network Adapter: Identifies the Interface manufacturer

• Physical Address: Indicates whether the interface has a physical interface

• Transport Name: Indicates the name of the protocol running over (or bound to) this interface

IPv4 and IPv6 information can be discovered by running a different command, ipconfig /all, as shown in Figure 4-5.

The same basic information (IPv4 address, IPv6 address, subnet mask, etc.) is available here as the GUI, but additional information is also available. In particular:

• The IPv6 DUID, described in Chapter 2, “Addresses”

• The physical interface address

• The default gateway

In most situations, starting Powershell and running ipconfig /all is the quickest way to find all the network information you need about a host. The ipconfig command can be used for more than showing current configuration information; it can also be used to

• /release: Release DHCP-learned IPv4 addresses

• /renew: Renew the DHCP-learned IPv4 addresses

• /release6: Release DHCP-learned IPv6 addresses

• /renew6: Renew DHCP-learned IPv6 addresses

• /flushdns: Flush the local DNS cache

Two other pieces of network information available from Powershell are difficult to find in any GUI display: the local ARP cache and routing table. To see the local ARP cache, use the arp -a command, as shown in Figure 4-6.

Each IP address is shown with its matching physical address in the table. Addresses marked dynamic were learned using ARP. Addresses marked static are embedded in the operating system software; for instance, the IP broadcast address (255.255.255.255) is always mapped to the physical interface broadcast address (ff-ff-ff-ff-ff-ff).

Figure 4-7 illustrates the Windows 11 host routing table, as displayed using the Get-NetRoute command from Powershell.

Several fields are of interest in the output shown in Figure 4-7:

• ifIndex: Indicates which interface to send packets through when following this route.

• DestinationPrefix: Indicates the destination network.

• NextHop: Identifies where to send packets to reach this destination; 0.0.0.0 means “this device” or the local host.

• RouteMetric: Indicates the metric, or cost to reach this destination. Windows hosts use the hop count as a metric.

• ifMetric: Indicates the default metric for routes reachable through this interface.

macOS

Apple’s macOS is the operating system used by every Macintosh computer. There are three ways to display physical and interface addresses on macOS computers: the GUI, the CLI, and the System Information application.

System Preferences

Open the System Preferences app and select the Network icon. Figure 4-8 illustrates the resulting dialog.

Select either the Ethernet port or a port labeled LAN (Local Area Network) for the wired connection. Fields of note include

• IPv4 Address: The IPv4 address assigned to the interface.

• Subnet Mask: The subnet mask, which indicates the network prefix. In this case, the subnet mask is 255.255.255.0, so the prefix length is /24.

• Router: The default gateway.

• DNS Server: The IP address of the server this host will use to resolve domain names.

If you remember the reserved IP addresses from Chapter 2, you will recognize the address 127.0.0.1 as a loopback address; any packets sent to this address loop back to the host. Some hosts set the DNS server to a loopback address and then use an internal process to capture and process DNS packets.

If you select the dropdown next to Configure IPv4, you can select to configure the IPv4 address either Using DHCP or

• Using DHCP with a manual address, which means you will manually configure an IP address on this interface, but DHCP will be used to discover the correct DNS server and default gateway.

• Using BootP, which uses an older, largely deprecated protocol called BootP to configure the IP address, default gateway, etc.

• Manually, which means you will insert the correct IP address, default gateway, and other information in the fields in the dialog.

Selecting the Advanced option and then the Hardware tab results in the dialog shown in Figure 4-9.

The Hardware tab shows the physical address for this interface.

The Terminal Command Line

Like most other hosts, Apple Macintosh computers have a command line you can use to examine and configure network parameters. You can typically find an application called Terminal under Applications, Utilities in the Finder app. Once you have launched the terminal, you can display the network configuration using ifconfig, as shown in Figure 4-10.

A lot of information here will not look familiar because macOS provides a lot more information from the physical interfaces than Windows does (there are ways to get this information in Windows, but they involve using different commands than ifconfig). Most of this information, however, is not very useful for the average operator.

The important fields are

• en0 is the service name of the interface.

• ether bc contains the physical address.

• inet6 contains the IPv6 interface address and prefix length.

• inet contains the IPv4 interface address and subnet mask.

The output does not include the default gateway.

If you need to release and renew the DHCP-assigned IP address in macOS, you use a pair of commands:

sudo ipconfig set en0 BOOTP; sudo ipconfig set en0 DHCP

Make sure you replace en0 with the correct interface name. This first command sets the interface to retrieve a new IP address via the bootp protocol and forces the interface to release the DHCP learned address. Since bootp is no longer widely used, the interface will (most likely) not have an address once the first command is run.

The second command tells the host to request a new DHCP address from the server.

In macOS, unlike Windows 11, you can use the ifconfig command to set the IP address for an interface manually. However, because macOS manages IP addresses as part of a central configuration system configd, any address you set using ifconfig will be overwritten by configd.

You can tell configd to change the IP address on an interface using the command networksetup.

System Information

Finally, you can find information about network configuration in the System Information application, customarily located under Utilities in Finder. Two sections contain information on wired network interfaces: Ethernet and Network Locations.

Figure 4-11 shows the information in the System Information Ethernet section.

The Ethernet section of System Information displays information about the physical connection. This Ethernet port connects through a USB port, has a physical interface (MAC) address, and can support up to a 5 Gb/s data rate and the physical interface (MAC) address.

Figure 4-12 shows the correct section of the Locations tab, located under the Network portion of the System Information app.

The information displayed here is like that displayed in other places in macOS.

Linux

While the average user does not encounter the Linux operating system very often, Linux is widely used to support web-based enterprise-grade applications. If you work in a data center environment, in software development, or with automation, you will almost certainly encounter and use some variant of the Linux operating system.

Linux’s most common commands used to display network configuration are ifconfig and ip. Figure 4-13 illustrates ipconfig on Ubuntu Linux.

The fields of interest are

• inet: The IPv4 address.

• netmask: The subnet mask. Here, it is 255.255.240.0, so the prefix length is /28.

• inet6: The IPv6 address.

• prefixlen: The prefix length.

• scope: Whether this is a link-local or global address. Since the IPv6 address begins with fe80, this is a link-local address.

• ether: The physical address.

• RX packets: The number of packets received, dropped, etc.

• TS packets: The number of packets transmitted, dropped, etc.

Figure 4-14 shows the output of the ip addr command.

The output of ip addr shows the physical address, the IPv4 address (inet), and the IPv6 address (inet6). This output also includes some DHCP information: alid_lft forever preferred_lft forever means the DHCP lease lifetime is forever.

Configuring a static interface address requires editing /etc/netplan/01-netcfg.yaml, as Figure 4-15 illustrates, and then restarting the network software.

You can edit the file in any text editor, such as VI or Emacs, replacing the addresses: 203.0.113.4 /24 with the correct address and the default gateway, 203.0.113.1, with the correct default gateway address. The nameservers should also be replaced with their correct values.

Verifying Connectivity

Once network parameters are configured, you must verify the configuration is correct. ping and traceroute are the two most widely used utilities. The network in Figure 4-16 will be used throughout this section to illustrate tools commonly used to verify connectivity and their use.

Ping

The first application to use when verifying connectivity is ping. The ping application sends a series of ICMP packets, called the ICMP echo request, to the indicated IP address. The host should respond with an ICMP echo reply packet if it receives these packets.

For instance, you could verify connectivity from host A in the network illustrated in Figure 4-16 by

• Pinging B’s interface address, verifying local connectivity on the segment is working correctly.

• Pinging the interface address of C1, verifying connectivity to the default gateway is working correctly.

• Pinging the interface address of C2, verifying connectivity to the default gateway and the default gateway is configured correctly to route packets back to A.

• Pinging the interface address of E to verify connectivity is working across the entire network (or Internet) to the destination host.

You can also ping local broadcast and multicast addresses. For instance, pinging 203.0.113.255 (the network broadcast address) should elicit a response from every device connected to the segment. If you ping 203.0.113.255 from A, you should receive replies from B and C. Pinging a broadcast or multicast address can be especially useful to clear and rebuild a host’s IPv4 ARP cache and IPv6 neighbor table.

Ping is a versatile application with many options. Options for the ping application on Ubuntu Linux include

• -4: Use IPv4 packets only.

• -6: Use IPv6 packets only.

• -b: Allow pinging to a broadcast address (as described previously).

• -c: Send a specific number of ICMP echo packets; the default usually is 5 or 10 for most ping applications.

• -f: Flood ping, which provides a quick way to determine how many packets are being dropped between the source and destination.

• -i: Use a specific source address or interface.

• -p: “Pad” the ICMP echo packets with a specific pattern. This can be good for catching problems with the network transmitting packets of all 1s, all 0s, or some other specific content.

• -s: Pad the ICMP packets transmitted to a specific size; this can be good for determining if larger or smaller packets can be carried through the network.

• -t: Set the TTL to a specific number.

The source interface can be handy when verifying local connectivity if you cannot access a specific host. If you have access to router C but not to host B, you can ping B from C twice, using

• A source address of interface C1

• A source address of interface C2

If host B answers the ping sourced from C1 but not C2, the likely problem is B’s default gateway configuration.

Traceroute

Traceroute is another helpful piece of network diagnostics software installed on most hosts. Traceroute takes advantage of the TTL in each IP packet to find the path between the local host and a destination.

If you run a traceroute from host A in Figure 4-16 toward E:

1. The traceroute application at A will send an IP packet with a TTL of 1 and E’s destination address.

   1. Router C will receive this packet, decrement the TTL, discard the packet, and send an ICMP TTL expired response to A.

   2. The traceroute application at A has now discovered the first hop, or the first router on the path to E is C.

2. The traceroute application at A will send an IP packet with a TTL of 2 and E’s destination address.

   1. Router C will receive this packet, decrement the TTL to 1, and forward the packet to D.

   2. Router D will receive the packet, decrement the TTL to 0, discard the packet, and send an ICMP TTL expired response to A.

   3. The traceroute application at A has now discovered the second hop, or the second router on the path to E is D.

3. The traceroute application at A will send an IP packet with a TTL of 3 and E’s destination address.

   1. Router C will receive this packet, decrement the TTL to 2, and forward the packet to D.

   2. Router D will receive this packet, decrement the TTL to 1, and forward the packet to E.

   3. Host E will receive this packet, decrement the TTL to 0, discard the packet, and send an ICMP TTL expired response to A.

4. Because the traceroute application at A now has a response from the destination IP address, it will stop sending packets.

Figure 4-17 shows a typical traceroute output.

If you traceroute to a domain name (such as rule11.tech), most applications will resolve the name into a destination IP address.

Each output line describes a set of packets transmitted at the TTL indicated. Line 1 represents three packets sent with a TTL of 1; line 2 represents three packets sent with a TTL of 2, etc. Traceroute keeps track of how much time elapses between sending the packet and receiving an ICMP TTL expired response.

The address given for each device is generally (but not always) the interface address closest to the source of the traceroute packets. In Figure 4-17, if A sent a traceroute to host E, router C would respond from interface C1’s address, and router D would respond from interface D1’s address. It is important to remember you are not seeing the entire path in traceroute results; you cannot see the outbound interface from each device forwarding the packet.

An asterisk in the output, such as those shown in Figure 4-17, can mean one of several things:

• The device 13 hops away from the local host is configured not to send ICMP TTL expired replies.

• Some device between the local host and the device 13 hops away is configured to filter or block ICMP TTL expired replies.

Hosts sometimes do not send ICMP replies, and network operators sometimes block ICMP replies to improve network security.

Traceroute implementations vary in the kind of packet they send to discover the path. For instance, Windows sends ICMP echo request packets with various TTL settings to perform a traceroute, while most Linux implementations and Apple Macintosh macOS send User Datagram Protocol (UDP) packets.

Traceroute does not always detail the path from a host to a destination; Figure 4-18 illustrates.

In Figure 4-18, routers B and D are connected by a tunnel:

• Router B encapsulates packets inside a second header with interface D1’s address as the destination.

• When router D receives these packets, it removes the outer header and forwards them based on the inner header toward host E.

Because router C only receives a packet with a destination address of interface D1, it does not examine the internal packet nor process it in any other way; it just receives the packet. It forwards it to router D. This means router C will not decrement the TTL in the original packet transmitted by host A nor respond.

Router C will not be in the traceroute results from host A to E in this situation.

Finding Your Public IP Address

Network Address Translation (NAT), described in Chapter 2, can sometimes make verifying the connection between a host and servers on the Internet difficult. Figure 4-19 illustrates.

In Figure 4-19, host A communicates with server D using its local interface address 192.0.2.100. Unknown to A, router B has NAT configured and is translating 192.0.2.100 to 203.0.113.45 (and some port number, but the port number is not essential for this example).

In this example, 192.0.2.100 is the private IP address, and 203.0.113.45 is the public IP address.

If there is a problem with the host A to server D communication, and the user would like to know what the network looks like from server D’s perspective, the user needs to know what IP address D is using to reach A—or rather, A’s public IP address.

The simplest way to discover A’s public IP address is to open a web browser and use a service. Several are available on the Internet, including

• If you type “what is my IP address” into Google search, the search engine will show the public IP address for your host on a web page.

• If you open the web page at https://checkip.amazonaws.com, it will display the public IP address of your host.

• If you open the web page at https://infoip.io, it will display information about the public IP address and location of your host.

Some hosts, particularly those running Linux, may not have a web browser installed. You can use many of these same sites to find your public IP from the command line, such as

$ curl -s http://tnx.nl/ip

<97.95.136.20>

$ curl -s https://checkip.amazonaws.com

97.95.136.20

Chapter Review

This chapter took a break from the theory of how networks work and focused on how to configure three different kinds of hosts—Windows 11, macOS, and Linux—to connect to a wired network. There are multiple ways to configure these hosts, including GUI and CLI options. Network engineers tend to prefer CLIs for configuring and managing devices.

This chapter also considered two of the most important tools for verifying connectivity: ping and traceroute. Part V of this book will return to verifying connectivity and troubleshooting networks.

At this point, we have covered the basic process of sending a packet through a network. You should now understand IP addressing, routers, switches, and basic host wired network configuration. In the next chapter, we will take a break from operational internals and look at an overview of the various kinds of devices making up a computer network.

One key to doing well on the exams is to perform repetitive spaced review sessions. Review this chapter’s material using either the tools in the book or interactive tools for the same material found on the book’s companion website. Refer to the online Appendix D, “Study Planner,” element for more details. Table 4-2 outlines the key review elements and where you can find them. To better track your study progress, record when you completed these activities in the second column.

Table 4-2 Chapter Review Tracking

Review All the Key Topics

Table 4-3 lists the key topics for this chapter.

Table 4-3 Key Topics for Chapter 4

Key Terms You Should Know

Key terms in this chapter include

Settings app

Control Panel

CLI

Powershell

ipconfig

ifconfig

ping

traceroute

public IP address

Concepts and Actions

Review the concepts considered in this chapter using Table 4-4. You can cover the right side of this table and describe each concept or action in your own words to verify your understanding.

Table 4-4 Concepts and Actions