Networking fundamentals and configuration. If you want to pass XK0-006, you need to understand how a Linux machine talks to other devices, sends data across the internet, and gets an address that other machines can find. Without this skill, you cannot set up a server, fix a broken internet connection, or even install software from a remote repository.
Jump to a section
A simple way to picture Networking Fundamentals and Configuration
A post office mail sorter who manages a busy sorting office in a large city. Every letter or parcel that arrives has a destination address written on it. The sorter’s job is to read that address, decide which delivery route the item should take, and place it in the correct outgoing bin. Sometimes an item arrives with no address, a wrong address, or a damaged label. When that happens, the sorter checks a master address directory to see if there is a forwarding rule or a local delivery zone that might still get the item to the right person. The sorter also keeps a log of all items processed, noting any that got lost or returned, so the office can improve its routing.
In a computer network, the sorter’s role is performed by software called the network stack. The destination address on an envelope corresponds to an IP address. The sorting office itself is the host machine, and the outgoing bins represent different network interfaces (like Ethernet or Wi-Fi). The master address directory is the routing table, which tells the system where to send data packets next. The log of lost items is equivalent to error messages and connection timeouts. Just as a sorter can be reassigned to work a different shift if a new delivery route opens, a Linux administrator can reconfigure network interfaces, modify the routing table, and troubleshoot connectivity by inspecting logs and address assignments.
Networking is what lets two or more computers share information. When you type a web address into a browser, your computer sends a request across many routers and cables to a server somewhere else, and that server sends back the webpage. All of this depends on a few key pieces working together.
The most basic piece is the network interface. This is the hardware or virtual component that connects your computer to a network. On a physical machine, that is the Ethernet port or the Wi-Fi card. On a virtual machine, it might be a software-defined interface. Linux names these interfaces things like eth0, enp0s3, or wlan0. The system uses these names to keep track of which interface is which.
Every interface needs a unique identifier called an IP address (Internet Protocol address). Think of it like a house number on a street. Other computers use this address to send data specifically to your machine. IP addresses come in two main versions: IPv4 (for example, 192.168.1.10) and IPv6 (for example, 2001:db8::1). IPv4 addresses are 32 bits long and are the most common today, but IPv6 is becoming more important as more devices connect to the internet.
Along with the IP address, every interface also has a subnet mask. The subnet mask tells the computer which part of the IP address identifies the network and which part identifies the specific device on that network. For example, if your IP address is 192.168.1.10 and the subnet mask is 255.255.255.0, the first three numbers (192.168.1) are the network part, and the last number (10) is the host part. Together, the IP address and subnet mask define your local network segment.
Another essential setting is the default gateway. This is the IP address of the router that connects your local network to other networks, such as the internet. When your computer wants to send data to a device that is not on its own local network, it sends the data to the default gateway. The router then forwards the data onward. Without a correct default gateway, your machine can only talk to other devices on the same local network.
Finally, there is the DNS server (Domain Name System). DNS is like a phonebook for the internet. When you type a name like “google.com” into a browser, your computer asks the DNS server, “What is the IP address for that name?” The DNS server replies with an IP address, and then your computer can connect using the numerical address. Without DNS, you would have to memorise IP addresses for every website you wanted to visit.
All of these settings can be configured on a Linux system either temporarily or permanently. Temporary changes are made using commands like ip addr add or ifconfig (though ifconfig is older and less commonly used now). Permanent changes are made by editing configuration files stored in directories like /etc/network/interfaces (on Debian-based systems) or /etc/sysconfig/network-scripts/ (on Red Hat-based systems). Modern systems also use NetworkManager, which provides a command-line tool called nmcli and a graphical interface.
To see what your current network configuration looks like, you can run the ip addr command. It will show every network interface, its IP address, subnet mask, and state (up or down). To check your routing table (the list of rules that decide where data goes), use ip route. To test if you can reach another machine, use ping followed by an IP address or hostname. Ping sends a small packet and waits for a reply. If you get a reply, the connection works. If you get “Destination Host Unreachable” or “Request Timed Out,” there is a problem somewhere.
Troubleshooting connectivity often follows a pattern. First, check that your network interface is turned on and connected. Use ip link show to see if the interface state is UP. Second, check that you have a valid IP address. If you see 0.0.0.0 or 169.254.x.x, something is wrong. 169.254.x.x is a link-local address that the system assigns itself when it cannot get an address from a DHCP server. Third, try pinging your default gateway. If that fails, the issue is likely on your local network. Fourth, ping a public IP address like 8.8.8.8. If that works but pinging a domain name does not, the problem is probably DNS.
Dynamic Host Configuration Protocol (DHCP) is a service that automatically assigns IP addresses, subnet masks, default gateways, and DNS servers to devices on a network. Most home and office networks use DHCP. When you plug a laptop into an Ethernet cable or connect to Wi-Fi, your computer sends out a broadcast message saying, “I need an address.” A DHCP server on the network responds with a lease, giving your computer an IP address to use for a limited time. This saves you from having to manually configure every device on the network.
Static configuration, on the other hand, means you manually type in every setting. That is useful for servers or devices that must always have the same IP address. On a Linux server running a web application, a static IP ensures that clients can always find it at the same address, even after a reboot.
Network security also involves a firewall. A firewall is a set of rules that controls which data packets are allowed in and out of your machine. Linux has a built-in firewall called iptables (and its newer replacement, nftables). You can use the ufw (Uncomplicated Firewall) tool to manage rules more easily. By default, many Linux distributions block incoming connections but allow outgoing ones. You might need to open specific ports (like port 80 for HTTP or port 22 for SSH) to allow services to be accessed from other machines.
Check Your Interface State
Run ip link show to see if your network interface is UP or DOWN. If it is DOWN, bring it up with ip link set interface-name up. This is the first thing to check because no communication can happen on a disabled interface.
Verify Your IP Address
Run ip addr show to see the IP address assigned to your interface. If the address is missing or starts with 169.254, your machine could not get an IP from DHCP. You may need to request a new lease with dhclient or configure a static IP.
Check the Routing Table
Run ip route to view your routing table. Look for a line starting with default that shows the default gateway. Without a valid gateway entry, your machine cannot send data to networks outside your local subnet.
Test Local Connectivity
Ping your default gateway to confirm that you can reach the router on your local network. If this fails, the problem is likely a cable issue, a misconfigured interface, or a problem with the router itself.
Test Remote Connectivity and DNS
First ping a public IP address such as 8.8.8.8 to confirm internet connectivity. Then ping a domain name like google.com to test DNS resolution. If the IP ping works but the domain ping fails, your DNS settings are incorrect.
Imagine you are a junior Linux administrator for a small e-commerce company. The company has a single web server that hosts its online store. One morning, you get a ticket from support: “Customers cannot reach the website.” Your first task is to find out whether the problem is on the server itself or somewhere else on the network.
You log into the server via SSH (Secure Shell) from your own workstation. Immediately, you run the ip addr command. You see that the primary network interface, eth0, has an IP address but it shows the state as DOWN. That means the interface is not active. You run ip link set eth0 up to bring the interface online. Then you check the routing table with ip route. You see a default gateway entry pointing to 192.168.1.1. You ping that gateway: ping 192.168.1.1. It replies, so the local network is fine.
Next, you test internet connectivity by pinging a public IP: ping 8.8.8.8. That also replies. So the problem must be DNS. You check the DNS configuration in /etc/resolv.conf. You see that the DNS server is set to 192.168.1.1, but that router’s DNS forwarding stopped working overnight. You edit /etc/resolv.conf to temporarily add a public DNS server like 8.8.8.8. Now you try to curl the company’s domain and it works. The website comes back.
You record your actions in the ticketing system. Then you decide to make the DNS change permanent. You edit the network configuration file for that interface. On this Debian-based system, you edit /etc/network/interfaces and add the line dns-nameservers 8.8.8.8. You restart the networking service with systemctl restart networking. You verify that the change persists by checking /etc/resolv.conf after a minute.
Later, you discover that the server needs to host a second website on a different IP address. You need to add a second IP address to the same network interface. This is called an IP alias. You use the command ip addr add 192.168.1.15/24 dev eth0. You update the web server configuration to listen on that new IP. Now both websites are accessible.
As a routine task, you also harden the server’s firewall. You check the current rules with sudo ufw status. You see that SSH (port 22) is allowed, but HTTP (port 80) and HTTPS (port 443) are not. You run sudo ufw allow 80/tcp and sudo ufw allow 443/tcp. Then you enable the firewall with sudo ufw enable. Now the server is protected from unwanted connections but still serves web traffic.
Finally, you set up monitoring. You configure the system to log network interface statistics using tools like nload and vnstat. You schedule a cron job to email you the network usage report every morning. This way, you will be alerted if traffic suddenly spikes or drops, which could indicate an attack or a failure.
The XK0-006 exam tests your ability to configure network settings and troubleshoot connectivity in a Linux environment. Expect multiple-choice and performance-based questions that ask you to interpret command output, select the correct tool for a task, or identify what a specific configuration means.
One of the most tested topics is the ip command suite. You must know the difference between ip addr, ip link, and ip route. A common question shows you the output of ip addr and asks which line represents the IP address or the interface state. Another variant shows ip route output and asks which entry is the default gateway. They will often hide the answer by using unusual interface names (like ens33 or enp0s8) to confuse candidates who only memorised eth0.
Another heavy focus is DHCP versus static configuration. Questions might give you a scenario where a server cannot reach the internet after a reboot, and you must determine that the interface is set to DHCP but no DHCP server is available. The correct answer is often to change the configuration to a static IP. Traps include suggesting that you should restart the DHCP client or that you should set the IP to 169.254.x.x, which is the automatic private IP address (APIPA) range that indicates DHCP failure.
The /etc/resolv.conf file and DNS configuration are also heavily tested. Questions will show you the content of resolv.conf and ask which server will be queried first for DNS lookups. The order matters: resolvers are queried in the order they appear in the file. A common trap is that the file may be managed by NetworkManager or systemd-resolved, so directly editing it might not persist across reboots. The exam expects you to recognise that and use nmcli or the appropriate network configuration file instead.
Firewall basics appear in the exam. You need to know how to check the status of ufw, enable it, and allow or deny ports. They may show you a command like sudo ufw allow 22 and ask what port that opens. They may also ask about iptables commands, though ufw is more common in recent versions.
Troubleshooting steps are tested in order. You might be given a scenario and asked to identify the first command to run. The correct answer is almost always ip addr or ip link, not ping. The reasoning is that you should check your own configuration before trying to reach another machine. A common trap is jumping straight to ping a remote server, which will fail if your interface is down or your IP is missing.
Finally, the exam tests your understanding of subnet masks. They may give you an IP and subnet mask and ask for the network address. For example, 192.168.1.10 with mask 255.255.255.0 gives network 192.168.1.0. They might also ask what the broadcast address is, which is the last address in the subnet. In that example, it would be 192.168.1.255.
Key definitions to memorise:
IP address: unique identifier for a device on a network
Subnet mask: defines network portion and host portion of an IP address
Default gateway: IP address of the router that connects to other networks
DNS server: translates domain names to IP addresses
DHCP: automatically assigns IP configuration to devices
Interface: hardware or virtual network connection point
Routing table: set of rules that decide where data packets go
Use the ip addr command to view all network interfaces, their IP addresses, and whether each interface is up or down.
The default gateway is the router's IP address that your machine uses to reach devices outside your local network.
DNS servers translate human-readable domain names like google.com into numerical IP addresses that computers use to communicate.
DHCP automatically assigns IP configuration to devices on a network, which is simpler than manually setting static IPs for every device.
The /etc/resolv.conf file lists DNS servers, but on modern systems you must configure DNS through NetworkManager or interface config files for permanent changes.
When troubleshooting, always check the local interface state and IP address before testing connectivity to remote devices.
A subnet mask like 255.255.255.0 tells your computer which part of an IP address belongs to the network and which part identifies the specific device.
Use the ping command followed by an IP address to test if a remote machine is reachable over the network.
These come up on the exam all the time. Here's how to tell them apart.
IP Address
Logical address assigned by software or DHCP
Can change based on network configuration
Used for routing data across different networks
MAC Address
Physical address burned into the network interface hardware
Permanent and unique to each device
Used for communication within the same local network
DHCP
Automatically assigns IP configuration to devices
Easier to manage on large networks with many devices
IP address can change over time (leases expire)
Static IP
Manually configured IP address and settings
Ensures a device always has the same IP address
Useful for servers that must be reachable at a fixed address
IPv4
32-bit address, written as four decimal numbers (e.g. 192.168.1.1)
Supports about 4.3 billion unique addresses
Most widely used version on the internet today
IPv6
128-bit address, written as eight groups of hexadecimal numbers
Supports a vastly larger number of unique addresses
Increasingly adopted to replace IPv4 due to address exhaustion
Ping (ICMP)
Tests if a remote host is reachable and measures round-trip time
Sends echo request packets and waits for reply
Shows only success or failure, no path details
Traceroute
Traces the route packets take to a destination
Lists every router hop along the path
Useful for identifying where packet loss or latency occurs
iptables
Low-level firewall tool that directly manages kernel rules
Complex syntax and requires detailed chain and rule knowledge
More flexible but harder for beginners to use
ufw
Front-end tool that simplifies iptables rules for common scenarios
Uses simple commands like allow or deny for ports and services
Easier to learn and sufficient for most basic firewall needs
Mistake
An IP address is the same as a MAC address.
Correct
An IP address is a logical address assigned by software, while a MAC address is a permanent hardware address burned into the network interface. They serve different purposes: IP addresses for routing across networks, MAC addresses for local network communication.
Both are numbers associated with a network device, and beginners often hear them used interchangeably without understanding the distinction.
Mistake
The default gateway is the IP address of your own computer.
Correct
The default gateway is the IP address of the router that connects your local network to other networks, not your own machine. Your computer sends data to the gateway when it wants to reach a device outside your local subnet.
The word 'gateway' sounds like it could be something on your machine, and many people think their computer is the centre of the network.
Mistake
If you can ping an IP address, your internet connection is working fine.
Correct
Pinging an IP address only confirms that the network path to that specific IP is working. It does not test DNS resolution or that your web browser can connect to a server. You might have full internet connectivity but still fail to load a website if DNS is broken.
Ping is a simple test that people over-rely on. They assume any ping success means everything is okay, ignoring the separate DNS layer.
Mistake
Editing /etc/resolv.conf permanently sets your DNS servers.
Correct
On many modern Linux systems, /etc/resolv.conf is generated automatically by NetworkManager or systemd-resolved, so manual edits are overwritten on reboot or network restart. Permanent DNS configuration should be done in the network interface configuration files or through nmcli.
In older Linux distributions, directly editing resolv.conf was common and persisted. Beginners learn that old approach without realising modern systems manage it differently.
Mistake
The subnet mask determines the speed of your internet connection.
Correct
The subnet mask only defines the boundary between the network address and the host address within an IP. It has no effect on data transfer speed. Speed is determined by your internet plan, router hardware, and network congestion.
The term 'mask' sounds like something that could block or filter traffic, leading people to think it affects performance.
Mistake
A static IP address is always better than DHCP.
Correct
Static IPs are useful for servers and devices that need a fixed address, but DHCP is more efficient for client devices like laptops and phones. Using static IPs everywhere can lead to address conflicts and administrative overhead.
Static IPs give a sense of control and reliability, so beginners assume they are superior in all cases.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Both show network configuration, but ip addr show is the modern Linux utility and is part of the iproute2 package. ifconfig is deprecated and may not be installed by default on newer distributions.
You can bring the interface up by running the command sudo ip link set eth0 up (replace eth0 with your interface name). If it goes down again, there may be a physical problem or a driver issue.
That is a link-local address assigned automatically when your computer cannot reach a DHCP server. It means your machine is not getting a valid IP from the network, so you need to check the DHCP server or configure a static IP.
It means the first three numbers of the IP address identify the network, and the last number identifies the specific device. For example, in 192.168.1.10 with that mask, the network is 192.168.1.0 and the host is 10.
You edit the network configuration file for your distribution. On Debian/Ubuntu, that is /etc/network/interfaces. On Red Hat/CentOS, it is a file in /etc/sysconfig/network-scripts/. You can also use nmcli if NetworkManager is running.
The default gateway is the IP address of the router that connects your local network to the internet. Your computer needs it to send data to devices outside your own subnet, because the gateway forwards packets to other networks.
You've finished Networking Fundamentals and Configuration. Continue through the XK0-006 study guide to build a complete picture of the exam.
Done with this chapter?