1. Start with the Big Picture

Imagine a Linux server that needs to send a packet to 8.8.8.8. Before anything leaves the machine, the kernel must determine which network interface should carry the packet and where it should be sent next.

Linux makes this decision using its routing table. But before we examine routes, we need to understand the interface that actually connects the server to the network.

2. What Is a Network Interface?

A network interface is the operating system’s connection point to a network. It can represent a physical Ethernet adapter, a virtual network adapter, a loopback device, a bridge, a VPN tunnel, or another networking mechanism.

Common Linux Interface Names

3. Inspect Interfaces with ip addr

The modern Linux networking toolkit is provided by iproute2. One of the first commands to learn is:

$ ip addr

A simplified result may look like this:

1: lo: <LOOPBACK,UP,LOWER_UP>
    inet 127.0.0.1/8 scope host lo

2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP>
    link/ether 52:54:00:ab:cd:ef
    inet 192.168.1.20/24 brd 192.168.1.255
    inet6 fe80::5054:ff:feab:cdef/64 scope link

There is a lot of information here, but the important parts are easier to understand when separated.

4. IP Addresses: The Server’s Network Identity

An IP address identifies an interface at the IP layer. A server can have one IP address, several addresses on the same interface, or addresses distributed across multiple interfaces.

Private vs Public IPv4 Addresses

Private IPv4 ranges are reserved for internal networking and are not globally routed across the public Internet.

5. What Does /24 Mean?

When Linux displays an address such as:

192.168.1.20/24

the /24 is the prefix length. It tells Linux how much of the IPv4 address identifies the network.

A /24 corresponds to the subnet mask 255.255.255.0. In this example, the subnet is:

192.168.1.0/24

Addresses inside that subnet can normally be reached directly at the local network layer. Traffic for destinations outside the subnet usually requires a router.

Common Prefix Lengths

6. The Loopback Interface

Every Linux administrator should recognize:

127.0.0.1

This is the familiar IPv4 loopback address, commonly associated with localhost. Traffic sent to it does not leave the machine.

Applications frequently bind to 127.0.0.1 when they should only be reachable locally.

$ ping -c 4 127.0.0.1

7. What Is a Routing Table?

Having an IP address is not enough. Linux also needs rules telling it which path to use for different destination networks.

Those rules live in the routing table.

Display the main routing table with:

$ ip route

You may see:

default via 192.168.1.1 dev ens3
192.168.1.0/24 dev ens3 proto kernel scope link src 192.168.1.20

8. Reading ip route Line by Line

192.168.1.0/24 dev ens3 proto kernel scope link src 192.168.1.20

default via 192.168.1.1 dev ens3

9. What Is the Default Gateway?

The default gateway is the next-hop router Linux uses when it does not have a more specific route for a destination.

Suppose the server is:

Server IP:       192.168.1.20/24
Default gateway: 192.168.1.1
Destination:     8.8.8.8

8.8.8.8 is not part of 192.168.1.0/24. The server therefore cannot treat it as a directly connected host.

Linux finds the default route and forwards the packet toward 192.168.1.1. The router then takes responsibility for forwarding it toward its final destination.

10. How Linux Chooses a Route

Linux does not simply use the default gateway for every packet. It first looks for a route that best matches the destination.

In general, the most specific matching prefix is preferred. This is commonly called longest prefix matching.

default via 10.0.0.1 dev ens3
10.0.0.0/8 dev ens3
10.20.0.0/16 via 10.0.0.2 dev ens3

For a destination such as 10.20.5.10, the 10.20.0.0/16 route is more specific than 10.0.0.0/8, so the more specific route is selected.

11. Ask Linux Which Route It Will Use

One of the most useful troubleshooting commands is:

$ ip route get 8.8.8.8

Example output:

8.8.8.8 via 192.168.1.1 dev ens3 src 192.168.1.20

This immediately tells you several useful things:

• The destination Linux evaluated is 8.8.8.8.
• The next-hop gateway is 192.168.1.1.
• The outgoing interface is ens3.
• The selected source address is 192.168.1.20.

12. Interface State with ip link

If networking fails, checking whether an interface is enabled is a good early diagnostic step.

$ ip link

Or inspect a specific interface:

$ ip link show ens3

An interface can exist and even have configuration associated with it while still being administratively down, so interface state matters during troubleshooting.

13. A Practical Linux Network Troubleshooting Sequence

When a Linux server cannot reach the network, avoid randomly running commands. Test the networking path in layers.

$ ip link

$ ip addr

$ ip route

$ ip route get 1.1.1.1

14. Test the Network Layer by Layer

Step 1 — Test Loopback

$ ping -c 4 127.0.0.1

This verifies basic local IP networking. It does not test the physical or virtual network outside the host.

Step 2 — Test the Gateway

$ ping -c 4 192.168.1.1

If the gateway responds, the server can communicate with at least that local network endpoint. Keep in mind that some systems intentionally block ICMP echo requests, so a failed ping is not always definitive proof that the gateway is unreachable.

Step 3 — Test an External IP Address

$ ping -c 4 1.1.1.1

If an external IP is reachable but domain names fail, the underlying IP path may be working while DNS resolution is broken.

Step 4 — Test DNS Resolution

$ getent hosts example.com

getent is useful because it queries name resolution through the system’s configured Name Service Switch mechanisms rather than assuming DNS is the only possible source.

15. Understanding a Common Failure Scenario

Suppose a server shows:

inet 10.10.5.20/24 dev ens3

but ip route only shows:

10.10.5.0/24 dev ens3 proto kernel scope link src 10.10.5.20

The server knows how to reach hosts on 10.10.5.0/24, but there is no default route shown.

Unless another routing table or policy-routing rule supplies a path, ordinary traffic to destinations outside the directly connected subnet will have no matching route.

16. The Commands You Should Remember

17. Interfaces, Addresses, Routes, and Ports Are Different Layers

Beginners often mix these concepts together. They are related, but they answer different questions.

18. A Packet’s Journey

We can now put the entire process together.

• An application generates network traffic for a destination.
• The Linux kernel evaluates the destination IP address.
• The routing rules and tables determine the appropriate route.
• Linux selects an outgoing interface and source address.
• If required, the packet is sent toward a next-hop gateway.
• Routers continue forwarding the packet toward the destination.
• Transport-layer information such as TCP or UDP ports identifies the relevant application endpoint.

19. Quick Troubleshooting Cheat Sheet