Learn / Networking Fundamentals / Addressing

How Machines Find Each Other

guidedeasy 25 min · 95 points

First Bit is still up for grabs: be the first to finish this room.

In IP Addresses & Subnets you learned to read an address on paper. Now look at a real machine: which addresses does it have, where does it send traffic, and can it reach another machine at all? These three questions are where every network problem, and every network investigation, starts.

CYB//RANGE Live lab

Task 1 Your own addresses

A machine talks to networks through interfaces: a network card, a Wi-Fi adapter, or a virtual one. ip addr (short: ip a) lists them with their addresses, and ip -br addr gives a one-line-per-interface summary:

$ ip -br addr
lo               UNKNOWN        127.0.0.1/8 ::1/128
eth0             UP             192.168.1.42/24 fe80::a00:27ff:fe4e:66a1/64

lo is the loopback interface. 127.0.0.1 always means "this machine itself", on every computer.
eth0 is a real network interface. 192.168.1.42/24 is its address and prefix length, the notation from the last room.
UP means the interface is switched on.

Inside containers and virtual machines you'll often see a name like eth0@if123. The interface is eth0; the @if123 part only says which interface on the host it's paired with.

Addresses starting fe80: are IPv6 link-local addresses, which every IPv6 interface gives itself automatically. You can ignore them for now.

Which command lists a Linux machine's network interfaces and their addresses? (Two words.)

** ****

What address does every machine use to talk to itself?

***.*.*.*

Task 2 Routes and gateways

Having an address isn't enough: a machine also needs to know where to send each packet. That's the routing table, shown by ip route:

$ ip route
default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.42

Read it from the most specific line up:

192.168.1.0/24 dev eth0: anything on the local network goes straight out of eth0, no middleman.
default via 192.168.1.1: everything else is handed to the gateway (usually a router) at 192.168.1.1, which passes it on towards the internet.

No default line means the machine can only reach its own local network. That's exactly how you'd build an isolated lab.

Which command shows where a machine sends traffic for each network? (Two words.)

** *****

The route used for every address not covered by a more specific route is called the ... route?

*******

Task 3 Testing reachability

ping sends small "are you there?" messages (ICMP echo requests) and reports each reply:

$ ping -c 3 192.168.1.1
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.41 ms
...
3 packets transmitted, 3 received, 0% packet loss

On Linux, ping keeps going until you press Ctrl+C. -c 3 stops after three.

A reply proves the other machine is reachable. No reply doesn't prove it's down, though: firewalls often drop ping on purpose. And "Network is unreachable" means your own machine has no route to that address, which is worth checking with ip route.

Which ping option sets how many requests to send before stopping?

**

Task 4 Try it on a real machine

Press Launch in CybRange at the top of this page, then Open terminal next to box once it's ready. You're logged in as hana.
Look at the machine's interfaces with ip -br addr and its routes with ip route.
Try ping -c 2 127.0.0.1 and ping -c 2 10.66.0.10. Then try ping -c 2 1.1.1.1. What happens, and why? (Your routing table explains it.)
ls ~/interfaces shows a notes file for several interface names, each holding a flag. Only the file for the interface that has the lab address holds the one that scores.

What IPv4 address does the lab machine have?

**.**.*.**

What is its prefix length (the number after the slash)?

**

Does the lab machine have a default route? (yes or no)

**

~/interfaces has a notes file per interface name, each holding a flag, but only the one for the interface that has the lab address scores. What is it?

RZ{************************}