Linux Networking Fundamentals for Ethical Hackers

Short answer: To work effectively on Linux as an ethical hacker, you need the TCP/IP model (the four layers that move data across a network), a mental map of addresses, ports, and protocols, and fluency with the modern iproute2 tools, ip and ss, plus tcpdump for capture and dig for DNS. These replaced the legacy ifconfig and netstat.

TL;DR: Know the four-layer TCP/IP model, then learn ip, ss, tcpdump, and dig — these four tools let you enumerate interfaces, inventory services, capture traffic, and map DNS on any Linux system you test.

Key Takeaways - The TCP/IP model has four layers (link, internet, transport, application), defined in RFC 1122. It is distinct from the seven-layer OSI model. - You cannot attack or defend what you cannot see, so enumeration of interfaces, routes, and open ports comes first. - The modern ip and ss commands (iproute2) have replaced ifconfig and netstat (net-tools) on current distributions. - tcpdump captures and inspects traffic; dig resolves and troubleshoots DNS.

Start with the model, not the tools

Tools change; the model endures. The TCP/IP model, defined by the IETF in RFC 1122, describes how data moves in four layers. Each layer wraps the one above it, so a web request becomes an application message, then a transport segment, then an internet packet, then link-layer frames on the wire.

A quick note on a common mix-up: the four-layer TCP/IP model is not the seven-layer OSI model (ISO/IEC 7498-1). OSI is a teaching reference; TCP/IP is what the internet actually runs on. Know both exist, but reason in TCP/IP terms when working on Linux.

The modern command-line toolkit

On current distributions, the iproute2 package provides the tools you should learn. They replaced the older net-tools commands, which may not be installed by default anymore.

• ip — show and configure interfaces, addresses, and routes. ip addr and ip route replace ifconfig and route. See the ip(8) manual page.
• ss — list sockets and listening ports, replacing netstat. ss -tulpn shows listening TCP and UDP services. See the ss(8) manual page.
• tcpdump — capture and inspect packets on the wire, essential for understanding what is really being sent. See the tcpdump manual.
• dig — query DNS to resolve names, troubleshoot records, and map a target's naming surface, maintained by ISC.

ip addr                 # interfaces and their IP addresses
ip route                # the routing table
ss -tulpn               # listening TCP/UDP ports and owning processes
sudo tcpdump -i eth0    # capture live traffic on an interface
dig example.com A       # resolve a domain's A records

In a pentest context, a typical enumeration sequence ties these tools together. First, run ip addr to map all active interfaces and identify which network segments the host is connected to. Second, run ss -tulpn to inventory every listening service — this tells you what is running and on which port before you ever touch a scanner. Third, run dig <domain> @<DNS-server> to test DNS resolution and confirm that the server you intend to target resolves correctly. These three steps take under a minute and give you the situational awareness to work deliberately rather than blindly. Before running any of these commands, make sure you understand the file permissions on tools and output files — the model in Linux file permissions explained for security professionals is a required prerequisite.

Why ip and ss replaced ifconfig and netstat

The legacy net-tools suite (ifconfig, netstat, route, arp) is effectively unmaintained. The iproute2 tools talk to the kernel through netlink sockets, expose features the old tools never supported, and ship by default on modern distributions. If a tutorial still teaches ifconfig, treat it as dated.

How this maps to ethical hacking

Enumeration is the first and most important phase of almost every engagement, and it is fundamentally a networking exercise. You identify live hosts, open ports, and running services before you ever think about exploitation. The deeper you understand layers, addresses, and ports, the faster and more complete your enumeration becomes. This foundation feeds directly into the hands-on scanning tasks covered in the CEH practical exam preparation guide, and it builds on the Linux commands every cybersecurity beginner should know.

Frequently asked questions

What is the TCP/IP model?

The TCP/IP model, defined in RFC 1122, describes how network data moves in four layers: link, internet, transport, and application. Each layer wraps the one above it, so an application message is packaged into transport segments, internet packets, and link-layer frames.

What is the difference between the TCP/IP model and the OSI model?

The TCP/IP model has four layers and describes how the internet actually works. The OSI model has seven layers and is a conceptual teaching reference. They overlap but are not identical, so avoid mapping them one-to-one.

Which Linux networking commands should an ethical hacker learn?

Learn the modern iproute2 tools ip (interfaces, addresses, routes) and ss (sockets and listening ports), plus tcpdump for packet capture and dig for DNS. These have replaced the older ifconfig and netstat.

Should I still use ifconfig and netstat?

Prefer ip and ss. The older ifconfig and netstat come from the unmaintained net-tools package and may not be installed by default on current distributions, while the iproute2 tools are the maintained standard.

---

ThreatBlock's Linux Essentials course teaches networking the way hackers use it, with live enumeration labs on real topologies.

About the author: Samaksh is Lead Instructor at ThreatBlock and holds the OSCP, CRTP, CRTO, and CEH certifications, with hands-on experience in penetration testing and red teaming. Read more on the author page · Editorial policy.