Don't Panic — Linux Networking

Linux networking is the kernel network stack and the tools that configure it. It gives each network context interfaces, addresses, routes, and packet-filtering paths, and it lets one kernel hold several isolated stacks through network namespaces. That last part is why containers can have their own addresses on a shared host.

Before namespaces existed, a host had one network stack, and every service on it had to share one set of routes and one port space. The stack still does what it did then; namespaces just gave it more than one place to do it.

Three ideas hold the practice up. A connection is two routes that agree, not one route that works — the outbound path gets the packet off the host, the return path gets the reply back, and most "the network is broken" reports are a return failure the outbound side cannot see. The ip command from iproute2 is the control surface, speaking netlink to the kernel and replacing the deprecated net-tools (ifconfig, route, netstat) that misrepresent modern state. And a network namespace is another copy of the stack with its own routes and firewall rules — a network isolation boundary, not an authorization one.

The one thing that surprises people: DNS is not reachability. A name can resolve to the correct address while the listener, the packet policy, the forwarding bit, or the return path still prevents a connection. Reachability is a chain, and DNS proves only its first two links.

The thing that catches every team: the hard part is not the commands. ip syntax is learnable in a day. The hard part is identifying which boundary a failure lives at — name, address, route, link, neighbor, policy, listener, or return path — and changing one boundary at a time. A team that changes several at once fixes things and cannot say how, then breaks them the same way next week.

A subtle one: enabling IPv4 forwarding is a routing decision, not a connectivity fix. The kernel resets several IPv4 configuration parameters to their defaults when the bit flips, so a host tuned for a specific forwarding profile can silently lose that tuning. The trade is usually correct; making it without knowing it happened is not.

Read the Intro for the full packet path and the boundaries it crosses. The Cheatsheet is the reference you will reach for when you forget what ip route get returns and how to read it. The Timeline shows how a stack that started with ifconfig and route gained netlink, network namespaces, nftables, and eBPF — and why the older commands still in your runbooks were deprecated fifteen years ago.