Host & Wire · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
Link layer
ip -br link | Interfaces, state and MAC addresses |
ip neigh | ARP/neighbour table (IP → MAC) |
sudo tcpdump -eni eth0 arp | Watch ARP requests and replies, with MACs |
cat /proc/net/bonding/bond0 | Bond mode and member link status |
ip -d link show eth0.100 | VLAN details (id, parent) |
MTU
ip link show eth0 | grep mtu | Interface MTU |
ping -M do -s 1472 10.0.0.20 | Test a full 1500-byte packet without fragmentation |
tracepath 10.0.0.20 | Discover the path MTU |
Routing
ip route | Main routing table |
ip route get 10.96.0.10 | Which route and source address a destination uses |
ip rule | Policy routing rules (which table to consult) |
ip route show table all | head | Routes in every table |
NAT & conntrack
sudo iptables -t nat -S | head -40 | NAT rules (iptables-based kube-proxy) |
sudo nft list ruleset | less | All nftables rules |
sudo conntrack -L | head | Tracked connections (conntrack-tools) |
sudo conntrack -S | Per-CPU stats, including drops and insert failures |
sysctl net.netfilter.nf_conntrack_count net.netfilter.nf_conntrack_max | Current vs maximum tracked connections |
See connections
ss -tan state established | wc -l | How many established connections |
ss -tan | awk 'NR>1 {print $1}' | sort | uniq -c | Connections per state |
ss -ti dst 10.0.5.20 | Per-connection RTT, cwnd, retransmits |
nstat -az | grep -E 'TcpRetransSegs|ListenOverflows|ListenDrops' | Kernel TCP counters |
Capture
sudo tcpdump -ni any 'tcp port 443 and (tcp[tcpflags] & (tcp-syn|tcp-rst) != 0)' | Only SYNs and RSTs |
sysctl net.ipv4.tcp_congestion_control | Congestion control algorithm (cubic, bbr…) |
Build it by hand
sudo ip netns add pod1 | Create a network namespace (a 'pod') |
sudo ip link add veth-pod1 type veth peer name veth-host1 | A virtual cable with two ends |
sudo ip link set veth-pod1 netns pod1 | Plug one end into the namespace |
sudo ip link add br0 type bridge && sudo ip link set veth-host1 master br0 | Plug the other end into a bridge |
sudo ip netns exec pod1 ip addr | Run a command inside the namespace |
Inspect a real node
ip -br link | grep -E 'veth|cali|lxc|cni' | Host-side ends of pod veth pairs (names depend on the CNI) |
sudo nsenter -t <pid> -n ip route | A pod's routes, from the node |
ls /etc/cni/net.d/ /opt/cni/bin/ | CNI config and plugin binaries |
