Network Device Operations Manual
On this page
Narrow the fault through interface, address, route, neighbor, DNS and service layers. Record state before changing the configuration owner. Address and default-route changes on a remote host need working recovery access.
| Task | Start here |
|---|---|
| No connectivity | Layered inspection |
| Wrong egress or DNS | Routes and policy |
| Configure interface / Wi-Fi | Runtime and persistent config |
Inspect link and address separately
Identify the interface and link state
# List interfaces and link flags compactly
Replace enp1s0 below with the actual interface. UP is administrative state; LOWER_UP indicates lower-layer availability.
# Inspect interface addresses and prefixes
Expand with ip address show dev enp1s0 for scope and lifetimes. Missing addresses and missing routes are different failures.
# Read interface error and drop counters
Compare increments under the same load; lifetime totals are not this request’s loss.
# Inspect physical-link speed, duplex, and carrier
Virtual interfaces may not support it. Query ethtool -S separately for driver-specific counters and correlate kernel link-reset logs.
| Observation | Meaning | Next check |
|---|---|---|
| UP / LOWER_UP | Admin enabled / lower-layer carrier are distinct | No carrier: cable, switch port, negotiation; virtual links differ |
| IP address | An address does not prove the route is correct | Check prefix, source, lifetime and route get |
| RX/TX errors, drops | Cumulative counts are not a current rate | Compare deltas under load with driver-specific counters |
Ask the kernel which path a destination uses
Ask the kernel which route it selects
# Query the route selected for an IPv4 destination
Read dev, via, and src; use the real target. Query IPv6 separately with ip -6 route get; IPv4 success says nothing about IPv6.
# Inspect policy rules selecting routing tables
Read priorities and matches; VPNs, sources, and marks may affect lookup. Inspect table contents separately.
# Inspect installed routes across tables
A default route does not prove that traffic uses its table; correlate route get.
# Inspect ARP/NDP state for next-hop neighbors
FAILED/INCOMPLETE indicate unresolved reachability. STALE normally needs observation, not flushing.
Check name resolution and listeners separately
# Resolve the destination through system NSS
With systemd-resolved, inspect per-link DNS and routing domains using resolvectl status. getent may include hosts entries and differs from dig.
# Inspect TCP/UDP listeners on the service host
-l selects listeners, -n numeric addresses, -t/-u protocols, and -p accessible process information. Loopback listeners do not directly accept remote-address requests.
Inspect dev, via and src. Policy rules, source and marks can choose a routing table before longest-prefix matching; main/default alone is incomplete. STALE neighbors are normally awaiting reachability confirmation, not a reason to flush. DNS answers do not prove listening ports; failed ping can mean filtered ICMP.
Choose a test that distinguishes failure layers
# Test ICMP replies from the verified next hop
Replace the example with the actual gateway. Filtering can suppress replies; test the application protocol too.
# Inspect the probed path and discovered path MTU
Probes can follow different policy from application traffic; an unresponsive hop does not necessarily drop application packets.
# Observe progress through DNS, TCP, TLS, and HTTP
Connect timeout limits connection setup; add --max-time for the whole request. Inspect the last successful phase rather than treating TLS errors as routing failures.
# Capture only the target host’s HTTPS TCP traffic
-n avoids reverse lookup and -i fixes the interface. Reproduce once, inspect SYN/replies/retransmissions, and stop with Ctrl-C. Use -w for a dedicated capture file if needed.
Replace gateway and target placeholders. Observe outgoing SYNs, responses, retransmissions and interface direction; not every timeout is DNS. /proc/net/dev holds interface statistics; soft interrupts are in /proc/softirqs.
To add one temporary address on a test interface, use ip address add 192.0.2.10/24 dev enp1s0; remove that exact address with ip address del, not an interface-wide flush. Replace the documentation subnet and check conflicts. Persistent configuration belongs to the manager below.
Use one configuration owner per interface
Identify the interface manager first
# Inspect NetworkManager state and connection names
For systemd-networkd, use networkctl status enp1s0 and inspect Network File. Do not configure one interface through both managers.
# Match active interfaces to profile names and UUIDs
Obtain YOUR_PROFILE here; quote names containing spaces and use UUIDs for ambiguity.
# Inspect saved settings and active parameters
Record methods, addresses, gateways, DNS, and routes. Make a restricted backup of the profile file; locate it with nmcli -f NAME,UUID,FILENAME connection show.
Add a temporary address on a test interface
# Add one verified conflict-free test address
This changes temporary kernel state. Verify the address and test the subnet; a manager or DHCP may overwrite it.
# Remove only the address added for this test
This is the later cleanup step, not an immediate sequel to add. Do not flush the entire interface.
Persist a NetworkManager DNS change
# Save the verified DNS server in this profile
Replace the example with a reachable policy-appropriate resolver. This replaces ipv4.dns and ignores automatic IPv4 DNS; assess IPv6 DNS separately.
# Reapply supported active-profile changes to the interface
Failure may require profile reactivation, not a reboot. Use connection up with recovery access if needed. Check effective DNS and resolution; restore original values to roll back.
Scan Wi-Fi before connecting
# Inspect visible SSIDs, signal, and security
Identify the interface and configuration for hidden SSIDs, enterprise authentication, or multiple radios.
# Prompt for credentials and connect to the selected network
--ask avoids credential arguments. After connection, verify addresses, routing, and requests.
VLAN: match the parent and switch configuration
This independent temporary VLAN example requires an unmanaged test interface, not the current SSH path. The parent needs link and the switch must allow VLAN 100. Substitute planned addressing.
# Create VLAN 100 on the parent interface
Verify parent and ID with ip -d link show before assigning an address.
# Assign the VLAN subnet address to the child interface
# Enable the child and test VLAN neighbors and services
Remove this test child afterward with ip link delete enp1s0.100. For persistence, use the selected manager’s VLAN profile.
Bridge: keep layer-three addressing on the bridge
Demonstrate only on an unused enp2s0 with no application address and a new br-test. Moving live addresses/default routes needs console access and a separate migration plan.
# Create a temporary layer-two bridge
# Attach the spare port without putting application IPs on it
Verify the master with bridge link show before enabling the port and bridge.
# Enable the bridge port
# Enable the bridge after its port
An unnumbered bridge demonstrates layer two only. Put planned host addresses on br-test for layer three. Cleanup detaches the port with nomaster, deletes br-test, and restores the port’s original state.
These identify the owner, not a recommendation to run both managers on one interface. --ask avoids a password in shell history. Profile and interface names differ. Review/back up the profile before modify/reapply or activation; reconnecting can break SSH. Runtime ip changes may be overwritten by DHCP and do not persist across reboot.
| Change | Check first |
|---|---|
| Runtime link up/down | ip link set dev enp1s0 up; run down separately, not up / down |
| Linux bridge | Host IP normally belongs on the bridge, ports forward L2; moving it disrupts the old path |
| VLAN | Match parent, VLAN ID, switch trunk and subnet |
| Unstable Wi-Fi | Inspect signal, band, congestion and regulatory domain; channel legality is regional |
Repeat the original destination test and verify persistence after reconnecting. See nftables, DNS and Tailscale for the next layer.