pwru is one of the best tools for troubleshooting Linux network issues. The full name of pwru is Packet Where Are You?,How does it work?eBPF allows us to attach hooks to kernel functions. When a kernel function is executed, eBPF can define additional actions, such as recording the function and its parameters and then printing them out.When Linux starts, it generates /proc/kallsyms, a file that pwru reads to locate all functions related to skb (the data structure for network packets in the kernel). Then, pwru hooks into these functions. This allows eBPF to track the exact path a packet takes th...

In an Ethernet environment, all data is ultimately sent in the form of a Layer 2 Ethernet Frame, which includes the Src MAC, Dst MAC, and other headers such as CRC, etc. Ethernet will then deliver the data to the destination.When we program, we often specify the IP and Port, but rarely specify the MAC address. So, how is the Frame sent out? This is done by the operating system. If the system does not know the MAC address corresponding to an IP, it will send a broadcast ARP request (since this request also needs to be sent over Ethernet, it will also fill in the Dst MAC, which is ff:ff:ff:ff:ff...

OverviewIn the previous article titled Why TCP needs 3 handshakes simple answers were provided to the following three questions:Can application data be carried during the first handshake?Can application data be carried during the second handshake?Can application data be carried during the third handshake?Briefly, traditional TCP requires a three-way handshake to establish a connection, and during these three handshakes, only simple SYN and ACK packets are sent.From the perspective of utilizing network bandwidth resources, the TCP header at the transport layer plus the IP header at the net...

Prerequisite KnowledgeFirst, let's look at the control bits and state machine of TCP, which form the basis for understanding the three-way handshake of TCP.TCP Packet Control BitsThe control bits in the TCP packet header are used to control the status of the TCP connection and can indicate various control information such as connection establishment, termination, reset, etc.There are six common control bits:SYN (Synchronize Sequence Numbers): Requests to establish a connection (part of the three-way handshake). It is set in the initial packet during connection establishment, indicating that th...

Lots of people would think what the address 127.0.0.1 is when first seeing this address. In fact, 127.0.0.1 is a loopback address which refers to the local machine. It is generally used for local testing. When typing ping 127.0.0.1 on local command console, it will send network packets to local IP/TCP layer to test whether IP/TCP works properly or not. To those who are used to use localhost, it is actually mapped to 127.0.0.1 by default. There are hosts files in the system which store this mapping. Hence normally these two can be interchanged.# localhost name resolution is handled within ...

In another post, we covered how to resolve SystemStackError when resolving IP address in Ruby. In this post, we would cover another common issue where a NXDomain error is returned when resolving an IP address. The NXDomain error means that the queried domain name does not exist in the DNS.In Ruby, DNS resolver library will use /etc/resolv.conf by default get the name servers to resolve the domain name. There are multiple DNS name servers can be specified in /etc/resolv.conf with below format.nameserver nameserver nameserver ...By default, only the top MAXNS name servers(3 in Linux by...

In Ruby, Resolv is the default DNS resolution implementation. It can be used to resolve IP address of a hostname. To use it, one just needs to require 'resolv' in the code. But sometimes, a user would want to check /etc/hosts first or some other mechanisms to resolve an IP address. In this case, one can require 'resolv-replace' and then replace the default DNS resolvers with customized DNS resolvers.For example, using resolv-replace, one would writerequire 'resolv-replace'Resolv::DefaultResolver.replace_resolvers([Resolv::Hosts.new, Resolv::DNS.new])Resolv.getaddress 'some-site.com'In this cas...

When a Linux server is running, it has to have an IP so that other machines can talk to it. It is often desired that the server would own a static IP so that every time other machines want to connect to it, the same IP address would be used. This is extremely useful when there are virtual machines installed on a host machine where the virtual machine would start and stop now and then. To configure static IP address for a Linux server, the /etc/network/interfaces needs to be updated. Assuming there is a host only network is created for a network interface named eth1. The configuration woul...