Contents
Abstract
Linux offers the necessary networking tools and features for integration into all types of network structures. The customary Linux protocol, TCP/IP, has various services and special features, which are discussed here. Network access using a network card, modem, or other device can be configured with YaST. Manual configuration is also possible. Only the fundamental mechanisms and the relevant network configuration files are discussed in this chapter.
Linux and other Unix operating systems use the TCP/IP protocol. It is not a single network protocol, but a family of network protocols that offer various services. The protocols listed in Table 30.1, “Several Protocols in the TCP/IP Protocol Family” are provided for the purpose of exchanging data between two machines via TCP/IP. Networks combined by TCP/IP, comprising a worldwide network are also referred to, in their entirety, as “the Internet.”
RFC stands for Request for Comments. RFCs are documents that describe various Internet protocols and implementation procedures for the operating system and its applications. The RFC documents describe the setup of Internet protocols. To expand your knowledge about any of the protocols, refer to the appropriate RFC documents. They are available online at http://www.ietf.org/rfc.html.
Table 30.1. Several Protocols in the TCP/IP Protocol Family¶
|
Protocol |
Description |
|---|---|
|
Transmission Control Protocol: A connection-oriented secure protocol. The data to transmit is first sent by the application as a stream of data then converted by the operating system to the appropriate format. The data arrives at the respective application on the destination host in the original data stream format in which it was initially sent. TCP determines whether any data has been lost during the transmission and that there is no mix-up. TCP is implemented wherever the data sequence matters. | |
|
User Datagram Protocol: A connectionless, insecure protocol. The data to transmit is sent in the form of packets generated by the application. The order in which the data arrives at the recipient is not guaranteed and data loss is a possibility. UDP is suitable for record-oriented applications. It features a smaller latency period than TCP. | |
|
Internet Control Message Protocol: Essentially, this is not a protocol for the end user, but a special control protocol that issues error reports and can control the behavior of machines participating in TCP/IP data transfer. In addition, it provides a special echo mode that can be viewed using the program ping. | |
|
Internet Group Management Protocol: This protocol controls machine behavior when implementing IP multicast. |
As shown in Figure 30.1, “Simplified Layer Model for TCP/IP”, data exchange takes place in different layers. The actual network layer is the insecure data transfer via IP (Internet protocol). On top of IP, TCP (transmission control protocol) guarantees, to a certain extent, security of the data transfer. The IP layer is supported by the underlying hardware-dependent protocol, such as ethernet.
The diagram provides one or two examples for each layer. The layers are ordered according to abstraction levels. The lowest layer is very close to the hardware. The uppermost layer, however, is almost a complete abstraction from the hardware. Every layer has its own special function. The special functions of each layer are mostly implicit in their description. The data link and physical layers represent the physical network used, such as ethernet.
Almost all hardware protocols work on a packet-oriented basis. The data to transmit is packaged in packets, because it cannot be sent all at once. The maximum size of a TCP/IP packet is approximately 64 KB. Packets are normally quite a bit smaller, because the network hardware can be a limiting factor. The maximum size of a data packet on an ethernet is about fifteen hundred bytes. The size of a TCP/IP packet is limited to this amount when the data is sent over an ethernet. If more data is transferred, more data packets need to be sent by the operating system.
For the layers to serve their designated functions, additional information regarding each layer must be saved in the data packet. This takes place in the header of the packet. Every layer attaches a small block of data, called the protocol header, to the front of each emerging packet. A sample TCP/IP data packet traveling over an ethernet cable is illustrated in Figure 30.2, “TCP/IP Ethernet Packet”. The proof sum is located at the end of the packet, not at the beginning. This simplifies things for the network hardware.
When an application sends data over the network, the data passes through each layer, all implemented in the Linux kernel except the physical layer. Each layer is responsible for preparing the data so it can be passed to the next layer. The lowest layer is ultimately responsible for sending the data. The entire procedure is reversed when data is received. Like the layers of an onion, in each layer the protocol headers are removed from the transported data. Finally, the transport layer is responsible for making the data available for use by the applications at the destination. In this manner, one layer only communicates with the layer directly above or below it. For applications, it is irrelevant whether data is transmitted via a 100 Mbit/s FDDI network or via a 56-Kbit/s modem line. Likewise, it is irrelevant for the data line which kind of data is transmitted, as long as packets are in the correct format.
The discussion in this section is limited to IPv4 networks. For information about IPv6 protocol, the successor to IPv4, refer to Section 30.2, “IPv6—The Next Generation Internet”.
Every computer on the Internet has a unique 32-bit address. These 32 bits (or 4 bytes) are normally written as illustrated in the second row in Example 30.1, “Writing IP Addresses”.
Example 30.1. Writing IP Addresses¶
IP Address (binary): 11000000 10101000 00000000 00010100 IP Address (decimal): 192. 168. 0. 20
In decimal form, the four bytes are written in the decimal number system, separated by periods. The IP address is assigned to a host or a network interface. It cannot be used anywhere else in the world. There are exceptions to this rule, but these are not relevant in the following passages.
The points in IP addresses indicate the hierarchical system. Until the 1990s, IP addresses were strictly categorized in classes. However, this system has proven too inflexible and was discontinued. Now, classless routing (CIDR, classless interdomain routing) is used.
Netmasks are used to define the address range of a subnetwork. If two hosts are in the same subnetwork, they can reach each other directly, if they are not in the same subnetwork, they need the address of a gateway that handles all the traffic between the subnetwork and the rest of the world. To check if two IP addresses are in the same subnet, simply “AND” both addresses with the netmask. If the result is identical, both IP addresses are in the same local network. If there are differences, the remote IP address, and thus the remote interface, can only be reached over a gateway.
To understand how the netmask works, look at
Example 30.2, “Linking IP Addresses to the Netmask”. The netmask consists of 32 bits
that identify how much of an IP address belongs to the network. All
those bits that are 1 mark the corresponding bit in
the IP address as belonging to the network. All bits that are
0 mark bits inside the subnetwork. This means that the
more bits are 1, the smaller the subnetwork is.
Because the netmask always consists of several successive
1 bits, it is also possible to just count the number
of bits in the netmask. In Example 30.2, “Linking IP Addresses to the Netmask” the
first net with 24 bits could also be written as
192.168.0.0/24.
Example 30.2. Linking IP Addresses to the Netmask¶
IP address (192.168.0.20): 11000000 10101000 00000000 00010100 Netmask (255.255.255.0): 11111111 11111111 11111111 00000000 --------------------------------------------------------------- Result of the link: 11000000 10101000 00000000 00000000 In the decimal system: 192. 168. 0. 0 IP address (213.95.15.200): 11010101 10111111 00001111 11001000 Netmask (255.255.255.0): 11111111 11111111 11111111 00000000 --------------------------------------------------------------- Result of the link: 11010101 10111111 00001111 00000000 In the decimal system: 213. 95. 15. 0
To give another example: all machines connected with the same ethernet cable are usually located in the same subnetwork and are directly accessible. Even when the subnet is physically divided by switches or bridges, these hosts can still be reached directly.
IP addresses outside the local subnet can only be reached if a gateway is configured for the target network. In the most common case, there is only one gateway that handles all traffic that is external. However, it is also possible to configure several gateways for different subnets.
If a gateway has been configured, all external IP packets are sent to the appropriate gateway. This gateway then attempts to forward the packets in the same manner—from host to host—until it reaches the destination host or the packet's TTL (time to live) expires.
Table 30.2. Specific Addresses¶
|
Address Type |
Description |
|---|---|
|
This is the netmask AND any address in the network, as shown in
Example 30.2, “Linking IP Addresses to the Netmask” under
| |
|
This basically says, “Access all hosts in this subnetwork.” To generate this, the netmask is inverted in binary form and linked to the base network address with a logical OR. The above example therefore results in 192.168.0.255. This address cannot be assigned to any hosts. | |
|
The address |
Because IP addresses must be unique all over the world, you cannot just select random addresses. There are three address domains to use if you want to set up a private IP-based network. These cannot get any connection from the rest of the Internet, because they cannot be transmitted over the Internet. These address domains are specified in RFC 1597 and listed in Table 30.3, “Private IP Address Domains”.
Table 30.3. Private IP Address Domains¶
|
Network/Netmask |
Domain |
|---|---|
|
|
|
|
|
|
|
|
|
![]() | IBM System z: IPv6 Support |
|---|---|
IPv6 is not supported by the CTC and IUCV network connections of the IBM System z hardware. | |
Due to the emergence of the WWW (World Wide Web), the Internet has experienced explosive growth with an increasing number of computers communicating via TCP/IP in the past fifteen years. Since Tim Berners-Lee at CERN (http://public.web.cern.ch) invented the WWW in 1990, the number of Internet hosts has grown from a few thousand to about a hundred million.
As mentioned, an IPv4 address consists of only 32 bits. Also, quite a few IP addresses are lost—they cannot be used due to the way in which networks are organized. The number of addresses available in your subnet is two to the power of the number of bits, minus two. A subnetwork has, for example, 2, 6, or 14 addresses available. To connect 128 hosts to the Internet, for example, you need a subnetwork with 256 IP addresses, from which only 254 are usable, because two IP addresses are needed for the structure of the subnetwork itself: the broadcast and the base network address.
Under the current IPv4 protocol, DHCP or NAT (network address translation) are the typical mechanisms used to circumvent the potential address shortage. Combined with the convention to keep private and public address spaces separate, these methods can certainly mitigate the shortage. The problem with them lies in their configuration, which is a chore to set up and a burden to maintain. To set up a host in an IPv4 network, you need a number of address items, such as the host's own IP address, the subnetmask, the gateway address, and maybe a name server address. All these items need to be known and cannot be derived from somewhere else.
With IPv6, both the address shortage and the complicated configuration should be a thing of the past. The following sections tell more about the improvements and benefits brought by IPv6 and about the transition from the old protocol to the new one.
The most important and most visible improvement brought by the new protocol is the enormous expansion of the available address space. An IPv6 address is made up of 128 bit values instead of the traditional 32 bits. This provides for as many as several quadrillion IP addresses.
However, IPv6 addresses are not only different from their predecessors with regard to their length. They also have a different internal structure that may contain more specific information about the systems and the networks to which they belong. More details about this are found in Section 30.2.2, “Address Types and Structure”.
The following is a list of some other advantages of the new protocol:
IPv6 makes the network “plug and play” capable, which means that a newly set up system integrates into the (local) network without any manual configuration. The new host uses its automatic configuration mechanism to derive its own address from the information made available by the neighboring routers, relying on a protocol called the neighbor discovery (ND) protocol. This method does not require any intervention on the administrator's part and there is no need to maintain a central server for address allocation—an additional advantage over IPv4, where automatic address allocation requires a DHCP server.
IPv6 makes it possible to assign several addresses to one network interface at the same time. This allows users to access several networks easily, something that could be compared with the international roaming services offered by mobile phone companies: when you take your mobile phone abroad, the phone automatically logs in to a foreign service as soon as it enters the corresponding area, so you can be reached under the same number everywhere and are able to place an outgoing call just like in your home area.
With IPv4, network security is an add-on function. IPv6 includes IPsec as one of its core features, allowing systems to communicate over a secure tunnel to avoid eavesdropping by outsiders on the Internet.
Realistically, it would be impossible to switch the entire Internet from IPv4 to IPv6 at one time. Therefore, it is crucial that both protocols are able to coexist not only on the Internet, but also on one system. This is ensured by compatible addresses (IPv4 addresses can easily be translated into IPv6 addresses) and through the use of a number of tunnels. See Section 30.2.3, “Coexistence of IPv4 and IPv6”. Also, systems can rely on a dual stack IP technique to support both protocols at the same time, meaning that they have two network stacks that are completely separate, such that there is no interference between the two protocol versions.
With IPv4, some services, such as SMB, need to broadcast their packets to all hosts in the local network. IPv6 allows a much more fine-grained approach by enabling servers to address hosts through multicasting—by addressing a number of hosts as parts of a group (which is different from addressing all hosts through broadcasting or each host individually through unicasting). Which hosts are addressed as a group may depend on the concrete application. There are some predefined groups to address all name servers (the all name servers multicast group), for example, or all routers (the all routers multicast group).
As mentioned, the current IP protocol is lacking in two important aspects: there is an increasing shortage of IP addresses and configuring the network and maintaining the routing tables is becoming a more complex and burdensome task. IPv6 solves the first problem by expanding the address space to 128 bits. The second one is countered by introducing a hierarchical address structure, combined with sophisticated techniques to allocate network addresses, as well as multihoming (the ability to assign several addresses to one device, giving access to several networks).
When dealing with IPv6, it is useful to know about three different types of addresses:
Addresses of this type are associated with exactly one network interface. Packets with such an address are delivered to only one destination. Accordingly, unicast addresses are used to transfer packets to individual hosts on the local network or the Internet.
Addresses of this type relate to a group of network interfaces. Packets with such an address are delivered to all destinations that belong to the group. Multicast addresses are mainly used by certain network services to communicate with certain groups of hosts in a well-directed manner.
Addresses of this type are related to a group of interfaces. Packets with such an address are delivered to the member of the group that is closest to the sender, according to the principles of the underlying routing protocol. Anycast addresses are used to make it easier for hosts to find out about servers offering certain services in the given network area. All servers of the same type have the same anycast address. Whenever a host requests a service, it receives a reply from the server with the closest location, as determined by the routing protocol. If this server should fail for some reason, the protocol automatically selects the second closest server, then the third one, and so forth.
An IPv6 address is made up of eight four-digit fields, each
representing 16 bits, written in hexadecimal notation. They are also
separated by colons (:). Any leading zero bytes
within a given field may be dropped, but zeros within the field or at
its end may not. Another convention is that more than four consecutive
zero bytes may be collapsed into a double colon. However, only one such
:: is allowed per address. This kind of shorthand
notation is shown in Example 30.3, “Sample IPv6 Address”, where all
three lines represent the same address.
Example 30.3. Sample IPv6 Address¶
fe80 : 0000 : 0000 : 0000 : 0000 : 10 : 1000 : 1a4 fe80 : 0 : 0 : 0 : 0 : 10 : 1000 : 1a4 fe80 : : 10 : 1000 : 1a4
Each part of an IPv6 address has a defined function. The first bytes
form the prefix and specify the type of address. The center part is the
network portion of the address, but it may be unused. The end of the
address forms the host part. With IPv6, the netmask is defined by
indicating the length of the prefix after a slash at the end of the
address. An address, as shown in Example 30.4, “IPv6 Address Specifying the Prefix Length”,
contains the information that the first 64 bits form the network part of
the address and the last 64 form its host part. In other words, the
64 means that the netmask is filled with 64 1-bit
values from the left. Just like with IPv4, the IP address is combined
with AND with the values from the netmask to determine whether the host
is located in the same subnetwork or in another one.
IPv6 knows about several predefined types of prefixes. Some of these are shown in Table 30.4, “Various IPv6 Prefixes”.
Table 30.4. Various IPv6 Prefixes¶
|
Prefix (hex) |
Definition |
|---|---|
|
|
IPv4 addresses and IPv4 over IPv6 compatibility addresses. These are used to maintain compatibility with IPv4. Their use still requires a router able to translate IPv6 packets into IPv4 packets. Several special addresses, such as the one for the loopback device, have this prefix as well. |
|
|
Aggregatable global unicast addresses. As is the case with IPv4, an
interface can be assigned to form part of a certain subnetwork.
Currently, there are the following address spaces:
|
|
|
Link-local addresses. Addresses with this prefix should not be routed and should therefore only be reachable from within the same subnetwork. |
|
|
Site-local addresses. These may be routed, but only within the
network of the organization to which they belong. In effect, they
are the IPv6 equivalent of the current private network address
space, such as |
|
|
These are multicast addresses. |
A unicast address consists of three basic components:
The first part (which also contains one of the prefixes mentioned above) is used to route packets through the public Internet. It includes information about the company or institution that provides the Internet access.
The second part contains routing information about the subnetwork to which to deliver the packet.
The third part identifies the interface to which to deliver the
packet. This also allows for the MAC to form part of the address.
Given that the MAC is a globally unique, fixed identifier coded into
the device by the hardware maker, the configuration procedure is
substantially simplified. In fact, the first 64 address bits are
consolidated to form the EUI-64 token, with the
last 48 bits taken from the MAC, and the remaining 24 bits containing
special information about the token type. This also makes it possible
to assign an EUI-64 token to interfaces that do
not have a MAC, such as those based on PPP or ISDN.
On top of this basic structure, IPv6 distinguishes between five different types of unicast addresses:
::
(unspecified)
This address is used by the host as its source address when the interface is initialized for the first time—when the address cannot yet be determined by other means.
::1 (loopback)
The address of the loopback device.
The IPv6 address is formed by the IPv4 address and a prefix consisting of 96 zero bits. This type of compatibility address is used for tunneling (see Section 30.2.3, “Coexistence of IPv4 and IPv6”) to allow IPv4 and IPv6 hosts to communicate with others operating in a pure IPv4 environment.
This type of address specifies a pure IPv4 address in IPv6 notation.
There are two address types for local use:
This type of address can only be used in the local subnetwork.
Packets with a source or target address of this type should not be
routed to the Internet or other subnetworks. These addresses
contain a special prefix
(fe80::/10) and the
interface ID of the network card, with the middle part consisting
of zero bytes. Addresses of this type are used during automatic
configuration to communicate with other hosts belonging to the
same subnetwork.
Packets with this type of address may be routed to other
subnetworks, but not to the wider Internet—they must remain
inside the organization's own network. Such addresses are used for
intranets and are an equivalent of the private address space
defined by IPv4. They contain a special prefix
(fec0::/10), the
interface ID, and a 16 bit field specifying the subnetwork ID.
Again, the rest is filled with zero bytes.
As a completely new feature introduced with IPv6, each network interface normally gets several IP addresses, with the advantage that several networks can be accessed through the same interface. One of these networks can be configured completely automatically using the MAC and a known prefix with the result that all hosts on the local network can be reached as soon as IPv6 is enabled (using the link-local address). With the MAC forming part of it, any IP address used in the world is unique. The only variable parts of the address are those specifying the site topology and the public topology, depending on the actual network in which the host is currently operating.
For a host to go back and forth between different networks, it needs at least two addresses. One of them, the home address, not only contains the interface ID but also an identifier of the home network to which it normally belongs (and the corresponding prefix). The home address is a static address and, as such, it does not normally change. Still, all packets destined to the mobile host can be delivered to it, regardless of whether it operates in the home network or somewhere outside. This is made possible by the completely new features introduced with IPv6, such as stateless autoconfiguration and neighbor discovery. In addition to its home address, a mobile host gets one or more additional addresses that belong to the foreign networks where it is roaming. These are called care-of addresses. The home network has a facility that forwards any packets destined to the host when it is roaming outside. In an IPv6 environment, this task is performed by the home agent, which takes all packets destined to the home address and relays them through a tunnel. On the other hand, those packets destined to the care-of address are directly transferred to the mobile host without any special detours.
The migration of all hosts connected to the Internet from IPv4 to IPv6 is a gradual process. Both protocols will coexist for some time to come. The coexistence on one system is guaranteed where there is a dual stack implementation of both protocols. That still leaves the question of how an IPv6 enabled host should communicate with an IPv4 host and how IPv6 packets should be transported by the current networks, which are predominantly IPv4 based. The best solutions offer tunneling and compatibility addresses (see Section 30.2.2, “Address Types and Structure”).
IPv6 hosts that are more or less isolated in the (worldwide) IPv4 network can communicate through tunnels: IPv6 packets are encapsulated as IPv4 packets to move them across an IPv4 network. Such a connection between two IPv4 hosts is called a tunnel. To achieve this, packets must include the IPv6 destination address (or the corresponding prefix) as well as the IPv4 address of the remote host at the receiving end of the tunnel. A basic tunnel can be configured manually according to an agreement between the hosts' administrators. This is also called static tunneling.
However, the configuration and maintenance of static tunnels is often too labor-intensive to use them for daily communication needs. Therefore, IPv6 provides for three different methods of dynamic tunneling:
IPv6 packets are automatically encapsulated as IPv4 packets and sent over an IPv4 network capable of multicasting. IPv6 is tricked into seeing the whole network (Internet) as a huge local area network (LAN). This makes it possible to determine the receiving end of the IPv4 tunnel automatically. However, this method does not scale very well and is also hampered by the fact that IP multicasting is far from widespread on the Internet. Therefore, it only provides a solution for smaller corporate or institutional networks where multicasting can be enabled. The specifications for this method are laid down in RFC 2529.
With this method, IPv4 addresses are automatically generated from IPv6 addresses, enabling isolated IPv6 hosts to communicate over an IPv4 network. However, a number of problems have been reported regarding the communication between those isolated IPv6 hosts and the Internet. The method is described in RFC 3056.
This method relies on special servers that provide dedicated tunnels for IPv6 hosts. It is described in RFC 3053.
To configure IPv6, you do not normally need to make any changes on the
individual workstations. IPv6 is enabled by default. You can disable it
during installation in the network configuration step described in Section 3.14.3, “Network Configuration”.
To disable or enable IPv6 on an installed system, use YaST
. Do not change the method and click
.
Then select a card and click +
in the tab.
To enable IPv6 manually, enter
modprobe ipv6 as
root.
Because of the autoconfiguration concept of IPv6, the network card is assigned an address in the link-local network. Normally, no routing table management takes place on a workstation. The network routers can be queried by the workstation, using the router advertisement protocol, for what prefix and gateways should be implemented. The radvd program can be used to set up an IPv6 router. This program informs the workstations which prefix to use for the IPv6 addresses and which routers. Alternatively, use zebra for automatic configuration of both addresses and routing.
Consult the ifup(8) man page to get information about how to set
up various types of tunnels using the
/etc/sysconfig/network files.
The above overview does not cover the topic of IPv6 comprehensively. For a more in-depth look at the new protocol, refer to the following online documentation and books:
The starting point for everything about IPv6.
All information needed to start your own IPv6 network.
The list of IPv6-enabled products.
Here, find the Linux IPv6-HOWTO and many links related to the topic.
The fundamental RFC about IPv6.
A book describing all the important aspects of the topic is IPv6 Essentials by Silvia Hagen (ISBN 0-596-00125-8).
DNS assists in assigning an IP address to one or more names and assigning a name to an IP address. In Linux, this conversion is usually carried out by a special type of software known as bind. The machine that takes care of this conversion is called a name server. The names make up a hierarchical system in which each name component is separated by dots. The name hierarchy is, however, independent of the IP address hierarchy described above.
Consider a complete name, such as
earth.example.com, written
in the format
hostname.domain. A full
name, referred to as a fully qualified domain name
(FQDN), consists of a hostname and a domain name
(example.com). The latter
also includes the top level domain or TLD
(com).
TLD assignment has become quite confusing for historical reasons.
Traditionally, three-letter domain names are used in the USA. In the rest
of the world, the two-letter ISO national codes are the standard. In
addition to that, longer TLDs were introduced in 2000 that represent
certain spheres of activity (for example,
.info,
.name,
.museum).
In the early days of the Internet (before 1990), the file
/etc/hosts was used to store the names of all the
machines represented over the Internet. This quickly proved to be
impractical in the face of the rapidly growing number of computers
connected to the Internet. For this reason, a decentralized database was
developed to store the hostnames in a widely distributed manner. This
database, similar to the name server, does not have the data pertaining
to all hosts in the Internet readily available, but can dispatch requests
to other name servers.
The top of the hierarchy is occupied by root name servers. These root name servers manage the top level domains and are run by the Network Information Center (NIC). Each root name server knows about the name servers responsible for a given top level domain. Information about top level domain NICs is available at http://www.internic.net.
DNS can do more than just resolve hostnames. The name server also knows which host is receiving e-mails for an entire domain—the mail exchanger (MX).
For your machine to resolve an IP address, it must know about at least one name server and its IP address. Easily specify such a name server with the help of YaST. If you have a modem dial-up connection, you may not need to configure a name server manually at all. The dial-up protocol provides the name server address as the connection is made. The configuration of name server access with SUSE Linux Enterprise® is described in Chapter 33, The Domain Name System.
The protocol whois is closely related to DNS. With
this program, quickly find out who is responsible for any given domain.
![]() | MDNS and .local Domain Names |
|---|---|
The If you want to switch off MDNS during installation, use
For more information on multicast DNS, see http://www.multicastdns.org. | |
There are many supported networking types on Linux. Most of them use different device names and the configuration files are spread over several locations in the file system. For a detailed overview of the aspects of manual network configuration, see Section 30.7, “Configuring a Network Connection Manually”.
During installation, YaST can be used to configure automatically all interfaces that have been detected. Additional hardware can be configured any time after installation in the installed system. The following sections describe the network configuration for all types of network connections supported by SUSE Linux Enterprise.
![]() | IBM System z: Hotpluggable Network Cards |
|---|---|
On IBM System z platforms, hotpluggable network cards are supported, but not their automatic network integration via DHCP (as is the case on the PC). After detection, manually configure the interface. | |
To configure your network wired or wireless card in YaST, select +. After starting the module, YaST displays a general network configuration dialog. Choose whether to use YaST or NetworkManager to manage all your network devices. If you want to configure your network in the traditional way with the YaST, check and click . To use NetworkManager, check and click . Find detailed information about NetworkManager in Section 30.6, “Managing Network Connections with NetworkManager”.
![]() | Network Method and Xen |
|---|---|
NetworkManager does not work with Xen. Only is available in Xen. | |
The upper part of the next dialog shows a list with all the network cards available for configuration. Any card properly detected is listed with its name. To change the configuration of the selected device, click . Devices that could not be detected can be configured using as described in Section 30.4.1.2, “Configuring an Undetected Network Card”.
To change the configuration of a network card, select a card from the list of the detected cards in the YaST network card configuration module and click . The dialog appears in which to adjust the card configuration using the and tabs. For information about wireless card configuration, see Section 29.1.3, “Configuration with YaST”.
When possible, wired network cards available during installation are automatically configured to use automatic address setup, DHCP.
![]() | IBM System z and DHCP |
|---|---|
On IBM System z platforms, DHCP-based address configuration is only supported with network cards that have a MAC address. This is only the case with OSA and OSA Express cards. | |
DHCP should also be used for a DSL line with no static IP assigned by the ISP. If you decide to use DHCP, configure the details in . Find this dialog from the tab by selecting +. Specify whether the DHCP server should always honor broadcast requests and any identifier to use. If you have a virtual host setup where different hosts communicate through the same interface, an identifier is necessary to distinguish them.
DHCP is a good choice for client configuration but it is not ideal for server configuration. To set a static IP address, proceed as follows:
Select a card from the list of detected cards in the YaST network card configuration module and click .
In the tab, choose .
Enter and .
Click .
To activate the configuration, click .
If you use the static address, name servers and a default gateway are not configured automatically. To configure a gateway, click and add the default gateway. To configure name servers, click and add addresses of name servers and domains.
One network device can have multiple IP addresses, called aliases. To set an alias for your network card, proceed as follows:
Select a card from the list of detected cards in the YaST network card configuration module and click .
In the tab, choose +.
Click .
Enter , , and .
Click .
Click again.
Click .
To activate the configuration, click .
If you did not change the network configuration during installation and the wired card was available, a hostname was automatically generated for your computer and DHCP was activated. The same applies to the name service information your host needs to integrate into a network environment. If DHCP is used for network address setup, the list of domain name servers is automatically filled with the appropriate data. If a static setup is preferred, set these values manually.
To change the name of your computer and adjust the name server search list, proceed as follows:
Select a card from the list of detected cards in the YaST network card configuration module and click .
In the tab, click .
To disable DHCP-driven host name configuration, deselect .
Enter and, if it is needed, .
To disable DHCP driven updates of the name server list, deselect .
Enter the name servers and domain search list.
Click .
Click .
To activate the configuration, click .
To make your machine communicate with other machines and other networks, routing information must be given to make network traffic take the correct path. If DHCP is used, this information is automatically provided. If a static setup is used, this data must be added manually.
Select a card from the list of detected cards in the YaST network card configuration module and click .
In the tab, click .
Enter the IP of the .
Click .
Click .
To activate the configuration, click .
Sometimes a module of a network card needs special parameters to work correctly. To set them with YaST, proceed as follows:
Select a card from the list of detected cards in the YaST network card configuration module and click .
In the tab, click +.
In , enter the parameters for your network card. If two cards are configured that use the same module, these parameters are used for both.
Click .
Click .
To activate configuration, click .
If you use the traditional method with ifup, you can configure your device to start during boot, on cable connection, on card detection, manually, or never. To change device start-up, proceed as follows:
Select a card from the list of detected cards in the YaST network card configuration module and click .
In the tab, select the desired entry from .
Click .
To activate the configuration, click .
Without having to enter the detailed firewall setup as described in Section 43.4.1, “Configuring the Firewall with YaST”, you can determine the basic firewall setup for your device as part of the device setup. Proceed as follows:
Select a card from the list of detected cards in the YaST network card configuration module and click .
Enter the tab of the network configuration dialog.
Determine the firewall zone to which your interface should be assigned. The following options are available:
All traffic will be blocked for this interface.
The firewall is run, but does not enforce any rules to protect this interface. Only use this option, if your machine is part of a greater network that is protected by an outer firewall.
A demilitarized zone is an additional line of defense in front of an internal network and the (hostile) Internet. Hosts assigned to this zone can be reached from the internal network and from the Internet, but cannot access the internal network.
The firewall is run on this interface and fully protects it against other (presumably hostile) network traffic. This is the default option.
Click .
Activate the configuration by clicking .
It may happen that your card is not detected correctly. In this case, the card is not included in the list of the detected cards. If you are sure that your system includes a driver for your card, you can configure it manually. To configure an undetected network card, proceed as follows:
Click .
Set the of the interface from the available options, , and . If the network card is a PCMCIA or USB device, activate the respective check box and exit this dialog with . Otherwise, select your network card model from . YaST then automatically selects the appropriate kernel module for the card.
specifies the name of the
/etc/sysconfig/hardware/hwcfg-*
file containing the hardware settings of your network
card. This contains the name of the kernel module as
well as the options needed to initialize the hardware.
Click .
In the tab, set the device type of the interface, the configuration name, and IP address. To use a static address, choose then complete and . Here, you can also select to configure the hostname, name server, and routing details (see Section 30.4.1.1.3, “Configuring Hostname and DNS” and Section 30.4.1.1.4, “Configuring Routing”).
If you selected as the device type of the interface, configure the wireless connection in the next dialog. Detailed information about wireless device configuration is available in Section 29.1, “Wireless LAN”.
In the tab, set the and . With , grant connection control to ordinary users.
Click .
To activate the new network configuration, click .
Information about the conventions for
configuration names is available in the
getcfg(8) man page.
![]() | IBM System z: Modem |
|---|---|
The configuration of this type of hardware is not supported on IBM System z platforms. | |
In the YaST Control Center, access the modem configuration with +. If your modem was not automatically detected, open the dialog for manual configuration by clicking . In the dialog that opens, enter the interface to which the modem is connected for .
![]() | CDMA and GPRS Modems |
|---|---|
Configure supported CDMA and GPRS modems with the YaST modem module just as you would configure regular modems. | |
If behind a private branch exchange (PBX), you may need to enter a dial prefix. This is often a zero. Consult the instructions that came with the PBX to find out. Also select whether to use tone or pulse dialing, whether the speaker should be on, and whether the modem should wait until it detects a dial tone. The last option should not be enabled if the modem is connected to an exchange.
Under , set the baud rate and the modem initialization strings. Only change these settings if your modem was not detected automatically or if it requires special settings for data transmission to work. This is mainly the case with ISDN terminal adapters. Leave this dialog by clicking . To delegate control over the modem to the normal user without root permissions, activate . In this way, a user without administrator permissions can activate or deactivate an interface. Under , specify a regular expression. The in KInternet, which can be modified by the normal user, must match this regular expression. If this field is left empty, the user cannot set a different without administrator permissions.
In the next dialog, select the ISP (Internet service provider). To choose from a predefined list of ISPs operating in your country, select . Alternatively, click to open a dialog in which to provide the data for your ISP. This includes a name for the dial-up connection and ISP as well as the login and password provided by your ISP. Enable to be prompted for the password each time you connect.
In the last dialog, specify additional connection options:
If you enable dial on demand, set at least one name server.
This option is enabled by default, with the effect that the name server address is updated each time you connect to the Internet.
If the provider does not transmit its domain name server after connecting, disable this option and enter the DNS data manually.
This option is enabled by default. With it, input prompts sent by the ISP's server are ignored to prevent them from interfering with the connection process.
Selecting this option activates the SUSEfirewall2 and sets the interface as external. This way, the system protected from outside attacks for the duration of your Internet connection.
With this option, specify a period of network inactivity after which the modem disconnects automatically.
This opens the address configuration dialog. If your ISP does not assign a dynamic IP address to your host, disable then enter your host's local IP address and the remote IP address. Ask your ISP for this information. Leave enabled and close the dialog by selecting .
Selecting returns to the original dialog, which displays a summary of the modem configuration. Close this dialog with .
![]() | IBM System z: ISDN |
|---|---|
The configuration of this type of hardware is not supported on IBM System z platforms. | |
Use this module to configure one or several ISDN cards for your system. If YaST did not detect your ISDN card, click and manually select it. Multiple interfaces are possible, but several ISPs can be configured for one interface. In the subsequent dialogs, set the ISDN options necessary for the proper functioning of the card.
In the next dialog, shown in Figure 30.5, “ISDN Configuration”, select the protocol to use. The default is , but for older or larger exchanges, select . If you are in the US, select . Select your country in the relevant field. The corresponding country code then appears in the field next to it. Finally, provide your and the if necessary.
defines how the ISDN interface should
be started: causes the ISDN
driver to be initialized each time the system boots.
requires you to load the ISDN driver as
root with the command rcisdn
start. , used for
PCMCIA or USB devices, loads the driver after the
device is plugged in. When finished with these settings, select
.
In the next dialog, specify the interface type for your ISDN card
and add ISPs to an existing interface. Interfaces may be either the
SyncPPP or the RawIP type,
but most ISPs operate in the SyncPPP mode, which
is described below.
The number to enter for depends on your particular setup:
A standard ISDN line provides three phone numbers (called multiple subscriber numbers, or MSNs). If the subscriber asked for more, there may be up to 10. One of these MSNs must be entered here, but without your area code. If you enter the wrong number, your phone operator automatically falls back to the first MSN assigned to your ISDN line.
Again, the configuration may vary depending on the equipment installed:
Smaller private branch exchanges (PBX) built for home purposes mostly use the Euro-ISDN (EDSS1) protocol for internal calls. These exchanges have an internal S0 bus and use internal numbers for the equipment connected to them.
Use one of the internal numbers as your MSN. You should be able to use at least one of the exchange's MSNs that have been enabled for direct outward dialing. If this does not work, try a single zero. For further information, consult the documentation that came with your phone exchange.
Larger phone exchanges designed for businesses normally use the 1TR6 protocol for internal calls. Their MSN is called EAZ and usually corresponds to the direct-dial number. For the configuration under Linux, it should be sufficient to enter the last digit of the EAZ. As a last resort, try each of the digits from 1 to 9.
For the connection to be terminated just before the next charge unit is due, enable . However, remember that may not work with every ISP. You can also enable channel bundling (multilink PPP) by selecting the corresponding option. Finally, you can enable SuSEfirewall2 for your link by selecting and . To enable the normal user without administrator permissions to activate or deactivate the interface, select the .
opens a dialog in which to
configure callback mode, remote connections to this interface and
additional ippd options. Leave the dialog by selecting
.
In the next dialog, make IP address settings. If you have not been given a static IP by your provider, select . Otherwise, use the fields provided to enter your host's local IP address and the remote IP address according to the specifications of your ISP. If the interface should be the default route to the Internet, select . Each host can only have one interface configured as the default route. Leave this dialog by selecting .
The following dialog allows you to set your country and select an ISP. The ISPs included in the list are call-by-call providers only. If your ISP is not in the list, select . This opens the dialog in which to enter all the details for your ISP. When entering the phone number, do not include any blanks or commas among the digits. Finally, enter your login and the password as provided by the ISP. When finished, select .
To use on a stand-alone
workstation, also specify the name server (DNS server). Most
ISPs support dynamic DNS, which means the IP address of a
name server is sent by the ISP each time you connect. For a single
workstation, however, you still need to provide a placeholder
address like 192.168.22.99. If your ISP does not support
dynamic DNS, specify the name server IP addresses of the ISP. If
desired, specify a time-out for the
connection—the period of network inactivity (in seconds)
after which the connection should be automatically
terminated. Confirm your settings with
. YaST displays a
summary of the configured interfaces. To make all these settings active,
select .
![]() | IBM System z: Cable Modem |
|---|---|
The configuration of this type of hardware is not supported on IBM System z platforms. | |
In some countries, such as Austria and the US, it is quite common to access the Internet through the TV cable network. The TV cable subscriber usually gets a modem that is connected to the TV cable outlet on one side and to a computer network card on the other (using a 10Base-TG twisted pair cable). The cable modem then provides a dedicated Internet connection with a fixed IP address.
Depending on the instructions provided by your ISP, when configuring the network card either select or . Most providers today use DHCP. A static IP address often comes as part of a special business account.
For further information about the configuration of cable modems, read the Support Database article on the topic, which is available online at http://old-en.opensuse.org/SDB:Setting_Up_an_Internet_Connection_via_Cable_Modem_with_SuSE_Linux_8.0_or_Higher.
![]() | IBM System z: DSL |
|---|---|
The configuration of this type of hardware is not supported on IBM System z platforms. | |
To configure your DSL device, select the module from the YaST section. This YaST module consists of several dialogs in which to set the parameters of DSL links based on one of the following protocols:
PPP over Ethernet (PPPoE)
PPP over ATM (PPPoATM)
CAPI for ADSL (Fritz Cards)
Point-to-Point Tunneling Protocol (PPTP)—Austria
The configuration of a DSL connection based on PPPoE or PPTP requires that
the corresponding network card has already been set up in the correct way.
If you have not done so yet, first configure the card by selecting
(see Section 30.4.1, “Configuring the Network Card with YaST”). In the case of a DSL link,
addresses may be assigned automatically but not via DHCP, which is why you
should not enable the option . Instead, enter a static dummy address for the interface,
such as 192.168.22.1. In
, enter 255.255.255.0. If you are configuring a
stand-alone workstation, leave empty.
![]() | |
Values in and are only placeholders. They are only needed to initialize the network card and do not represent the DSL link as such. | |
To begin the DSL configuration (see Figure 30.7, “DSL Configuration”), first
select the PPP mode and
the ethernet card to which the DSL modem is connected (in most cases, this
is eth0). Then use
to specify whether
the DSL link should be established during the boot process.
Click to authorize
the normal user without root permissions to activate or
deactivate the interface with KInternet.
The dialog also lets you select your country
and choose from a number of ISPs operating in it. The details
of any subsequent dialogs of the DSL configuration depend on the
options set so far, which is why they are only briefly mentioned in the
following paragraphs. For details on the available options, read the
detailed help available from the dialogs.
To use on a stand-alone
workstation, also specify the name server (DNS server). Most
ISPs support dynamic DNS—the IP address of a
name server is sent by the ISP each time you connect. For a single
workstation, however, provide a placeholder address like 192.168.22.99. If your ISP does not support
dynamic DNS, enter the name server IP address provided by your ISP.
defines a period of network inactivity after which to terminate the connection automatically. A reasonable time-out value is between 60 and 300 seconds. If is disabled, it may be useful to set the time-out to zero to prevent automatic hang-up.
The configuration of T-DSL is very similar to the DSL setup. Just select as your provider and YaST opens the T-DSL configuration dialog. In this dialog, provide some additional information required for T-DSL—the line ID, the T-Online number, the user code, and your password. All of these should be included in the information you received after subscribing to T-DSL.
SUSE Linux Enterprise for IBM System z supports several different types of network interfaces. YaST can be used to configure all of them.
To add a qeth-hsi (Hipersockets) interface to the
installed system, start the YaST network card module (+). Select one of the devices marked to use as the READ device address
and click . In the dialog, specify the IP address and netmask for the
new interface and leave the network configuration by pressing
and .
To add a qeth-ethernet (IBM OSA Express Ethernet Card)
interface to the installed system, start the YaST network card module
(+). Select one of the devices marked to use as the READ device address and click
. Enter the needed port name, some additional
options (see the Linux for IBM System z: Device Drivers,
Features, and Commands manual for reference at http://www.ibm.com/developerworks/linux/linux390/documentation_novell_suse.html), your IP address,
and an appropriate netmask. Leave the network configuration with
and .
To add a ctc (IBM parallel CTC Adapter) interface to the
installed system, start the YaST network card module (+). Select one of the devices marked to use as your read channel and click
. Choose the that fit your devices
(usually this would be ). Specify
both your IP address and the IP address of the remote partner. If needed,
adjust the MTU size with
+. Leave the network configuration with
and .
![]() | |
The use of this interface is deprecated. This interface will not be supported in future versions of SUSE Linux Enterprise. | |
To add an lcs (IBM OSA-2 Adapter) interface to the
installed system, start the YaST network card module (+). Select one of the devices marked and click . Enter the
needed port number, some additional options (see the Linux for
IBM System z: Device Drivers, Features, and Commands
manual for reference at http://www.ibm.com/developerworks/linux/linux390/documentation_novell_suse.html), your IP address, and an appropriate netmask. Leave
the network configuration with and
.
To add an iucv (IUCV) interface to the installed system,
start the YaST network card module (+). Select a device marked and click
. YaST prompts you for the name of your
IUCV partner. Enter the name (this entry is
case-sensitive) and select . Specify both your IP
address and the IP address of your partner. If needed, adjust the MTU size
with
+. Leave the network configuration with
and .
![]() | |
The use of this interface is deprecated. This interface will not be supported in future versions of SUSE Linux Enterprise. | |
VLAN is an abbreviation of Virtual Local Area
Network. It allows the running of multiple
logical (virtual) ethernets over one single physical
ethernet. It logically splits the network into different broadcast domains
so that packets are only switched between ports that are designated for
the same VLAN. If you intend to use VLAN in your network setup, make sure
that the package vlan is installed.
If the network connection of Linux is not dedicated to a specific logical LAN, you can set up access to one or more of these logical LANs. The VLAN interface configuration is supported via the normal ifup and ifdown scripts used for all other network interfaces, as well. The setup of VLAN devices is supported by YaST.
Run the YaST module +, select and press . Follow this procedure to actually setup the VLAN device:
Procedure 30.1. Setting up VLAN Interfaces with YaST
Press to create a new network interface.
In , select .
Change the value of to the ID of
your VLAN. Note that VLAN ID 1 is commonly used for
managing purposes.
Press .
Select the interface that the VLAN device should connect to below .
Select the desired method for assigning an IP address to the VLAN device.
Press to finish the configuration.
For more information about VLAN, see
http://www.candelatech.com/~greear/vlan.html and the
package documentation found at
/usr/share/doc/packages/vlan/.
NetworkManager is the ideal solution for a mobile workstation. With NetworkManager, you do not need to worry about reconfiguring network interfaces and switching between networks when your location changes. NetworkManager can automatically connect to known WLAN networks. If you have two or more connection possibilities, it can connect to the faster one.
NetworkManager is not a suitable solution in the following cases:
You want to use more than one provider for dial-up for one interface.
Your computer is a router for your network.
Your computer provides network services for other computers in your network, for example, it is a DHCP or DNS server.
Your computer is a Xen server or your system is a virtual system inside Xen.
You want to use SCPM for network configuration management. To use SCPM and NetworkManager at the same time, SCPM cannot control network resources. .
You want to use more than one active network connection simultaneously.
To enable or disable NetworkManager during the installation, click or in of . To enable or disable NetworkManager on an installed system, follow these steps:
Open YaST.
Choose +.
On the first screen, set the option to to use NetworkManager. To disable NetworkManager, set the option to .
After choosing the method, set up your network card using automatic configuration via DHCP or a static IP address or configure your modem. Find a detailed description of the network configuration with YaST in Section 30.4, “Configuring a Network Connection with YaST” and Section 29.1, “Wireless LAN”. Configure supported wireless cards directly in NetworkManager.
To configure NetworkManager, use NetworkManager applets. KDE and GNOME each have their own applets for NetworkManager. An appropriate applet should start automatically with the desktop environment. The applet is then shown as an icon in the system tray. The functions of the applets are similar, but their interfaces are a little different. They can also be used in other graphical environments with standard system tray support.
If you use NetworkManager for network setup, you can easily switch, stop, or start
your network connection at any time from within your desktop environment
using an applet. NetworkManager also makes it possible to change and configure
wireless card connections without requiring root privileges.
For this reason, NetworkManager is the ideal solution for a mobile workstation.
Traditional configuration with ifup also provides some ways to switch, stop,
or start the connection with or without user intervention, like user-managed
devices,
but it always requires root privileges to change or configure a network
device. This is often a problem for mobile computing, where is not possible
to preconfigure all connection possibilities.
Both traditional configuration and NetworkManager can handle network connections with a wireless network (with WEP, WPA-PSK, and WPA-Enterprise access), dial-up, and wired networks both using DHCP and static configuration. They also support connection through VPN.
NetworkManager tries to keep your computer connected at all times using the best connection available. If available, it uses the fastest wired connection. If the network cable is accidentally disconnected, it tries to reconnect. It can find a network with the best signal strength from the list of your wireless connections and automatically use it to connect. To get the same functionality with ifup, a great deal of configuration effort is required.
Find more information about NetworkManager on the following Web sites and directories:
http://www.gnome.org/projects/NetworkManager/—NetworkManager project page
http://old-en.opensuse.org/Projects/KNetworkManager—NetworkManager KNetworkManager project page
Manual configuration of the network software should always be the last alternative. Using YaST is recommended. However, this background information about the network configuration can also assist your work with YaST.
All built-in network cards and hotplug network cards (PCMCIA, USB, some PCI cards) are detected and configured via hotplug. The system sees a network card in two different ways: first as a physical device and second as an interface. The insertion or detection of a device triggers a hotplug event. This hotplug event triggers the initialization of the device with the script hwup. When the network card is initialized as a new network interface, the kernel generates another hotplug event that triggers the setup of the interface with ifup.
The kernel numbers interface names according to the temporal order of their registration. The initialization sequence is decisive for the assignment of names. If one of several network card fails, the numbering of all subsequently initialized cards is shifted. For real hotpluggable cards, the order in which the devices are connected is what matters.
To achieve a flexible configuration, the configuration of the device
(hardware) and the interface has been separated and the mapping of
configurations to devices and interfaces is no longer managed on the basis
of the interface names. The device configurations are located in
/etc/sysconfig/hardware/hwcfg-*. The interface
configurations are located in
/etc/sysconfig/network/ifcfg-*. The names of the
configurations are assigned in such a way that they describe the devices and
interfaces with which they are associated. Because the former mapping of
drivers to interface name required static interface names, this mapping can
no longer take place in /etc/modprobe.conf. In the new
concept, alias entries in this file would cause undesirable side effects.
The configuration names—everything after hwcfg- or
ifcfg-—can describe the devices by means of the
slot, a device-specific ID, or the interface name. For example, the
configuration name for a PCI card could be
bus-pci-0000:02:01.0 (PCI slot) or
vpid-0x8086-0x1014-0x0549 (vendor and product ID). The
name of the associated interface could be
bus-pci-0000:02:01.0 or
wlan-id-00:05:4e:42:31:7a (MAC address).
To assign a certain network configuration to any card of a certain type (of
which only one is inserted at a time) instead of a certain card, select less
specific configuration names. For example, bus-pcmcia
would be used for all PCMCIA cards. On the other hand, the names can be
limited by a preceding interface type. For example,
wlan-bus-usb would be assigned to WLAN cards connected to
a USB port.
The system always uses the configuration that best describes an interface or the device providing the interface. The search for the most suitable configuration is handled by getcfg. The output of getcfg delivers all information that can be used for describing a device. Details regarding the specification of configuration names are available in the manual page of getcfg.
With the described method, a network interface is configured with the correct configuration even if the network devices are not always initialized in the same order. However, the name of the interface still depends on the initialization sequence. There are two ways to ensure reliable access to the interface of a certain network card:
getcfg-interface returns the name of the associated
network interface. Therefore, the configuration name, such as firewall,
dhcpd, routing, or various virtual network interfaces (tunnels), can be
entered in some configuration files instead of the interface name, which
is not persistent.
configuration
name
Persistent interface names are assigned to each interface automatically.
You may adjust them to suit your needs. When creating interface names,
proceed as outlined in
/etc/udev/rules.d/30-net_persistent_names.rules.
However, the persistent name pname should not be
the same as the name that would automatically be assigned by the kernel.
Therefore, eth*, tr*,
wlan*, qeth*,
iucv*, and so on are not permitted. Instead,
use net* or descriptive names like
external, internal, or
dmz. Make sure that the same interface name is not used
twice. Allowed characters in interface names are restricted to
[a-zA-Z0-9]. A persistent name can only be assigned to
an interface immediately after its registration, which means that the
driver of the network card must be reloaded or
hwup must be executed. The command
rcnetwork device
descriptionrestart is not sufficient for
this purpose.
![]() | Using Persistent Interface Names |
|---|---|
The use of persistent interface names has not been tested in all areas. Therefore, some applications may not be able to handle freely selected interface names. | |
ifup requires an existing interface, because it does not
initialize the hardware. The initialization of the hardware is handled by the
command hwup (executed by hotplug or
coldplug). When a device is initialized,
ifup is automatically executed for the new interface via
hotplug and the interface is set up if the start mode is
onboot, hotplug, or
auto and the network service was
started. Formerly, the command
ifup
triggered the hardware initialization. Now the procedure has been reversed.
First, a hardware component is initialized then all other actions follow. In
this way, a varying number of devices can always be configured in the best
way possible with an existing set of configurations.
interfacename
Table 30.5, “Manual Network Configuration Scripts” summarizes the most important scripts involved in the network configuration. Where possible, the scripts are distinguished by hardware and interface.
Table 30.5. Manual Network Configuration Scripts¶
Configuration Stage | Command | Function |
|---|---|---|
Hardware | hw{up,down,status} |
The |
Interface | getcfg |
getcfg can be used to query the interface
name associated with a configuration name or a hardware description.
More information is available in the manual page of
|
Interface | if{up,down,status} |
The |
More information about hotplug and persistent device names is available in Chapter 24, Dynamic Kernel Device Management with udev.
This section provides an overview of the network configuration files and explains their purpose and the format used.
/etc/syconfig/hardware/hwcfg-*¶
These files contain the hardware configurations
of network cards and other devices. They contain the
needed parameters, such as the kernel module, start
mode, and script associations. Refer to the manual
page of hwup for details. Regardless
of the existing hardware, the hwcfg-static-*
configurations are applied when coldplug is started.
/etc/sysconfig/network/ifcfg-*¶
These files contain the configurations
for network interface. They include information
such as the start mode and the IP address.
Possible parameters are described in the
manual page of ifup.
Additionally, all variables from the files
dhcp, wireless,
and config can be used in
the ifcfg-* files
if a general setting should be used for only
one interface.
►zseries:
IBM System z do not support USB.
The names of the interface files and network
aliases contain System z-specific elements
like qeth.
◄
/etc/sysconfig/network/{config,dhcp,wireless}
¶
The file config contains general settings for the
behavior of ifup, ifdown, and
ifstatus. dhcp contains settings
for DHCP and wireless for wireless LAN cards. The
variables in all three configuration files are commented and can also be
used in ifcfg-* files, where they are treated with
higher priority.
/etc/sysconfig/network/{routes,ifroute-*}¶
The static routing of TCP/IP packets is determined
here. All the static routes
required by the various system tasks can be entered in the
/etc/sysconfig/network/routes file: routes to a host,
routes to a host via a gateway, and routes to a network. For each interface
that needs individual routing, define an additional configuration file:
/etc/sysconfig/network/ifroute-*. Replace
* with the name of the interface. The entries in the
routing configuration files look like this:
# Destination Dummy/Gateway Netmask Device # 127.0.0.0 0.0.0.0 255.255.255.0 lo 204.127.235.0 0.0.0.0 255.255.255.0 eth0 default 204.127.235.41 0.0.0.0 eth0 207.68.156.51 207.68.145.45 255.255.255.255 eth1 192.168.0.0 207.68.156.51 255.255.0.0 eth1
The route's destination is in the first column. This column may contain the IP address of a network or host or, in the case of reachable name servers, the fully qualified network or hostname.
The second column contains the default gateway or a gateway through which a
host or network can be accessed.
The third column contains the netmask for networks or hosts behind a
gateway. For example, the mask is 255.255.255.255 for a
host behind a gateway.
The fourth column is only relevant for networks connected to the local host such as loopback, Ethernet, ISDN, PPP, and dummy device. The device name must be entered here.
An (optional) fifth column can be used to specify the type of a route.
Columns that are not needed should contain a minus sign
- to ensure that the parser correctly interprets the
command. For details, refer to the routes(5) man
page.
/etc/resolv.conf¶
The domain to which the host belongs is specified in this file (keyword
search). Also listed is the status of the name
server address to access (keyword nameserver).
Multiple domain names can be specified. When resolving a name that is not
fully qualified, an attempt is made to generate one by attaching the
individual search entries. Use multiple
name servers
by entering several lines, each beginning with
nameserver. Precede comments with
# signs. YaST enters the specified
name server in this file. Example 30.5, “/etc/resolv.conf”
shows what /etc/resolv.conf could look like.
Example 30.5. /etc/resolv.conf¶
# Our domain search example.com # # We use sun (192.168.0.20) as nameserver nameserver 192.168.0.20
Some services, like pppd (wvdial),
ipppd (isdn), dhcp
(dhcpcd and dhclient),
pcmcia, and hotplug, modify
the file /etc/resolv.conf by means of the
script modify_resolvconf.
If the file /etc/resolv.conf has been temporarily
modified by this script, it contains a predefined comment giving
information about the service that modified it, the
location where the original file has been backed up, and how to
turn off the automatic modification mechanism.
If /etc/resolv.conf is modified several times, the
file includes modifications in a nested form. These can be reverted in
a clean way even if this reversal takes place in an order different from
the order in which modifications were introduced. Services that may need
this flexibility include isdn,
pcmcia, and
hotplug.
If a service was not terminated in a normal, clean way,
modify_resolvconf can be used to restore the original
file. Also, on system boot, a check is performed to see whether there
is an uncleaned, modified resolv.conf, for
example, after a
system crash, in which case the original (unmodified)
resolv.conf is restored.
YaST uses the command modify_resolvconf
check to find out whether
resolv.conf has been modified and subsequently
warns the user that changes will be lost after restoring the file.
Apart from this, YaST does not rely on
modify_resolvconf, which means that the impact of
changing resolv.conf through YaST is the same as
that of any manual change. In both cases, changes have
a permanent effect. Modifications requested by the
mentioned services are only temporary.
/etc/hosts
¶
In this file, shown in Example 30.6, “/etc/hosts”, IP addresses
are assigned to hostnames. If no name server is implemented, all hosts to
which an IP connection will be set up must be listed here. For each host,
enter a line consisting of the IP address, the fully qualified hostname,
and the hostname into the file. The IP address must be at the beginning of
the line and the entries separated by blanks and tabs. Comments are always
preceded by the # sign.
Example 30.6. /etc/hosts¶
127.0.0.1 localhost 192.168.0.20 sun.example.com sun 192.168.0.1 earth.example.com earth
/etc/networks¶
Here, network names are converted to network addresses. The format is
similar to that of the hosts file, except the network
names precede the addresses. See Example 30.7, “/etc/networks”.
/etc/host.conf¶
Name resolution—the translation of host and network names via the
resolver library—is controlled by this file.
This file is only used for programs linked to libc4 or libc5. For
current glibc programs, refer to the settings in
/etc/nsswitch.conf. A parameter must always stand
alone in its own line. Comments are preceded by a #
sign. Table 30.6, “Parameters for /etc/host.conf” shows
the parameters available. A sample /etc/host.conf is shown in
Example 30.8, “
/etc/host.conf
”.
Table 30.6. Parameters for /etc/host.conf¶
order hosts, bind | Specifies in which order the services are accessed for the name resolution. Available arguments are (separated by blank spaces or commas): |
hosts: Searches the
| |
bind: Accesses a name server | |
nis: Uses NIS | |
multi on/off | Defines if a host entered in
|
nospoof on spoofalert on/off | These parameters influence the name server spoofing, but, apart from that, do not exert any influence on the network configuration. |
trim domainname |
The specified domain name is separated from the hostname after
hostname resolution (as long as the hostname includes the domain
name).
This option is useful if only names from the local domain are in the
|
Example 30.8.
/etc/host.conf
¶
# We have named running order hosts bind # Allow multiple addrs multi on
/etc/nsswitch.conf¶
The introduction of the GNU C Library 2.0 was accompanied by the
introduction of the Name Service Switch (NSS). Refer
to the nsswitch.conf(5) man page and
The GNU C Library Reference Manual for details.
The order for queries is defined in the file
/etc/nsswitch.conf. A sample
nsswitch.conf is shown
in Example 30.9, “/etc/nsswitch.conf”.
Comments are introduced by # signs.
In this example, the entry under the hosts
database means that a request is
sent to /etc/hosts (files)
via DNS (see Chapter 33, The Domain Name System).
Example 30.9. /etc/nsswitch.conf¶
passwd: compat group: compat hosts: files dns networks: files dns services: db files protocols: db files netgroup: files automount: files nis
The “databases” available over NSS are listed in
Table 30.7, “Databases Available via /etc/nsswitch.conf”. In addition,
automount, bootparams,
netmasks, and publickey are
expected in the near future.
The configuration options for NSS databases are listed in
Table 30.8, “Configuration Options for NSS “Databases””.
Table 30.7. Databases Available via /etc/nsswitch.conf¶
|
Mail aliases implemented by |
| Ethernet addresses. |
|
For user groups, used by |
|
For hostnames and IP addresses, used by
|
|
Valid host and user lists in the network for the purpose of
controlling access permissions; see
the |
|
Network names and addresses, used by
|
|
User passwords, used by |
|
Network protocols, used by |
|
Remote procedure call names and
addresses, used by |
|
Network services, used by |
|
Shadow passwords of users, used by
|
Table 30.8. Configuration Options for NSS “Databases”¶
|
directly access files, for example,
|
| access via a database |
| NIS, see also Chapter 35, Using NIS |
|
can only be used as an extension for |
|
can only be used as an extension for |
/etc/nscd.conf¶
This file is used to configure nscd
(name service cache daemon). See
the nscd(8) and
nscd.conf(5) man pages.
By default, the system entries of passwd and
groups are cached by nscd.
This is important for the performance of
directory services, like NIS and LDAP,
because otherwise the network connection needs to be used
for every access to names or groups.
hosts is not cached by default, because the mechanism
in nscd to cache hosts makes the local
system unable to trust forward and reverse lookup checks. Instead
of asking nscd to cache names, set up
a caching DNS server.
If the caching for passwd
is activated, it usually takes about fifteen seconds
until a newly added local user is recognized. Reduce this waiting
time by restarting nscd
with the command
rcnscd restart.
/etc/HOSTNAME ¶This contains the hostname without the domain name attached. This file is read by several scripts while the machine is booting. It may only contain one line in which the hostname is set.
Before you write your configuration to the configuration files, you can test it. To set up a test configuration, use the ip command. To test the connection, use the ping command. Older configuration tools, ifconfig and route, are also available.
The commands ip, ifconfig, and route change the network configuration directly without saving it in the configuration file. Unless you enter your configuration in the correct configuration files, the changed network configuration is lost on reboot.
ip is a tool to show and configure routing, network devices, policy routing, and tunnels. It was designed as a replacement for the older tools ifconfig and route.
ip is a very complex tool.
Its common syntax is
ip .
You can work with the following objects:options
object command
This object represents a network device.
This object represents the IP address of device.
This object represents a ARP or NDISC cache entry.
This object represents the routing table entry.
This object represents a rule in the routing policy database.
This object represents a multicast address.
This object represents a multicast routing cache entry.
This object represents a tunnel over IP.
If no command is given, the default command is used, usually list.
Change the state of a device with the command ip link
set device_namecommand.
For example, to deactivate device eth0, enter ip link
seteth0 down. To activate it again, use
ip link seteth0 up.
After activating a device, you can configure it. To set the IP address,
use ip addr
add . For example, to set the
address of the interface eth0 to 192.168.12.154/30 with standard broadcast
(option ip_address + dev
device_namebrd), enter ip
addr add 192.168.12.154/30 brd + dev
eth0.
To have a working connection, you must also configure the default gateway.
To set a gateway for your system, enter ip route
get gateway_ip_address. To translate one
IP address to another, use nat: ip route add
nat ip_address via other_ip_address.
To display all devices, use ip link ls. To display the
running interfaces only, use ip link ls up. To print
interface statistics for a device, enter ip -s link
ls device_name. To view addresses of your
devices, enter ip addr. In the output of the
ip addr, also find information about MAC addresses of
your devices. To show all routes, use ip route show.
For more information about using ip, enter
ip help or see the
ip(8) man page. The help option
is also available for all ip objects. If, for example, you want to read
help for ip addr, enter
ip addr help. Find the ip manual
in /usr/share/doc/packages/iproute2/ip-cref.pdf.
The ping command is the standard tool for testing whether a TCP/IP connection works. It uses the ICMP protocol to send a small data packet, ECHO_REQUEST datagram, to the destination host, requesting an immediate reply. If this works, ping displays a message to that effect, which indicates that the network link is basically functioning.
ping does more than test only the function of the connection between two computers: it also provides some basic information about the quality of the connection. In Example 30.10, “Output of the Command ping”, you can see an example of the ping output. The second-to-last line contains information about number of transmitted packets, packet loss, and total time of ping running.
As the destination, you can use a hostname or IP address, for example,
ping example.com or
ping 130.57.5.75.
The program sends packets until you press
Ctrl+C.
If you only need to check the functionality of the connection, you can limit
the number of the packets with the -c option. For
example to
limit ping to three packets, enter
ping -c 3 192.168.0.
Example 30.10. Output of the Command ping¶
ping -c 3 example.com PING example.com (130.57.5.75) 56(84) bytes of data. 64 bytes from example.com (130.57.5.75): icmp_seq=1 ttl=49 time=188 ms 64 bytes from example.com (130.57.5.75): icmp_seq=2 ttl=49 time=184 ms 64 bytes from example.com (130.57.5.75): icmp_seq=3 ttl=49 time=183 ms --- example.com ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2007ms rtt min/avg/max/mdev = 183.417/185.447/188.259/2.052 ms
The default interval between two packets is one second. To change the interval,
ping provides option -i. For example to
increase ping interval to ten seconds, enter
ping -i 10 192.168.0.
In a system with multiple network devices, it is sometimes useful to send
the ping
through a specific interface address. To do so, use the -I
option with the name of the
selected device, for example,
ping -I wlan1 192.168.0.
For more options and information about using ping,
enter ping -h or see the
ping (8) man page.
ifconfig is a traditional network configuration tool. In contrast to ip, you can use it only for interface configuration. If you want to configure routing, use route.
![]() | ifconfig and ip |
|---|---|
The program ifconfig is obsolete. Use ip instead. | |
Without arguments, ifconfig displays the status of the currently active
interfaces.
As you can see in Example 30.11, “Output of the ifconfig Command”, ifconfig
has
very well-arranged and detailed output. The output also contains information
about the MAC address of your device, the value of HWaddr,
in the first line.
Example 30.11. Output of the ifconfig Command¶
eth0 Link encap:Ethernet HWaddr 00:08:74:98:ED:51
inet6 addr: fe80::208:74ff:fe98:ed51/64 Scope:Link
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:634735 errors:0 dropped:0 overruns:4 frame:0
TX packets:154779 errors:0 dropped:0 overruns:0 carrier:1
collisions:0 txqueuelen:1000
RX bytes:162531992 (155.0 Mb) TX bytes:49575995 (47.2 Mb)
Interrupt:11 Base address:0xec80
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:8559 errors:0 dropped:0 overruns:0 frame:0
TX packets:8559 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:533234 (520.7 Kb) TX bytes:533234 (520.7 Kb)
wlan1 Link encap:Ethernet HWaddr 00:0E:2E:52:3B:1D
inet addr:192.168.2.4 Bcast:192.168.2.255 Mask:255.255.255.0
inet6 addr: fe80::20e:2eff:fe52:3b1d/64 Scope:Link
UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1
RX packets:50828 errors:0 dropped:0 overruns:0 frame:0
TX packets:43770 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:45978185 (43.8 Mb) TX bytes:7526693 (7.1 Mb)For more options and information about using ifconfig,
enter ifconfig -h or see the
ifconfig (8) man page.
route is a program for manipulating the IP routing table. You can use it to view your routing configuration and add or remove of routes.
![]() | route and ip |
|---|---|
The program route is obsolete. Use ip instead. | |
route is especially useful if you need quick and comprehensible
information about your routing configuration to determine problems
with routing. To view your current routing configuration, enter
route
-n as root.
Example 30.12. Output of the route -n Command¶
route -n Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 10.20.0.0 * 255.255.248.0 U 0 0 0 eth0 link-local * 255.255.0.0 U 0 0 0 eth0 loopback * 255.0.0.0 U 0 0 0 lo default styx.exam.com 0.0.0.0 UG 0 0 0 eth0
For more options and information about using route,
enter route -h or see the
route (8) man page.
Apart from the configuration files described above, there are also various scripts that load the network programs while the machine is booting. These are started as soon as the system is switched to one of the multiuser runlevels. Some of these scripts are described in Table 30.9, “Some Start-Up Scripts for Network Programs”.
Table 30.9. Some Start-Up Scripts for Network Programs¶
This script handles the configuration of the network interfaces. The hardware must already have been initialized by /etc/init.d/coldplug (via hotplug). If the network service was not started, no network interfaces are implemented when they are inserted via hotplug. | |
Starts xinetd. xinetd can be used to make server services available on the system. For example, it can start vsftpd whenever an FTP connection is initiated. | |
Starts the portmapper needed for the RPC server, such as an NFS server. | |
Starts the NFS server. | |
Controls the postfix process. | |
Starts the NIS server. | |
Starts the NIS client. |
Some home users do not have a dedicated line connecting them to the Internet. Instead, they use dial-up connections. Depending on the dial-up method (ISDN or DSL), the connection is controlled by ipppd or pppd. Basically, all that needs to be done to go online is to start these programs correctly.
If you have a flat-rate connection that does not generate any additional costs for the dial-up connection, simply start the respective daemon. Control the dial-up connection with a KDE applet or a command-line interface. If the Internet gateway is not the host you are using, you might want to control the dial-up connection by way of a network host.
This is where smpppd is involved. It provides a uniform interface for auxiliary programs and acts in two directions. First, it programs the required pppd or ipppd and controls its dial-up properties. Second, it makes various providers available to the user programs and transmits information about the current status of the connection. As smpppd can also be controlled by way of the network, it is suitable for controlling dial-up connections to the Internet from a workstation in a private subnetwork.
The connections provided by smpppd are automatically configured by YaST. The actual dial-up programs KInternet and cinternet are also preconfigured. Manual settings are only required to configure additional features of smpppd, such as remote control.
The configuration file of smpppd is /etc/smpppd.conf.
By default, it does not enable remote control. The most important options
of this configuration file are:
yes|no
To control smpppd via the network, this option must be set to
yes. The port on which smpppd listens is
3185. If this parameter is set to
yes, the parameters bind-address,
host-range, and password should
also be set accordingly.
ip addressIf a host has several IP addresses, use this parameter to determine at which IP address smpppd should accept connections. The default is to listen at all addresses.
min ip max ip
The parameter host-range defines a network range.
Hosts whose IP addresses are within this range are granted access to
smpppd. All hosts not within this range are
denied access.
passwordBy assigning a password, limit the clients to authorized hosts. As this is a plain-text password, you should not overrate the security it provides. If no password is assigned, all clients are permitted to access smpppd.
yes|noWith this parameter, the smpppd service can be announced in the network via SLP.
More information about smpppd is available in the
smpppd(8) and
smpppd.conf(5)
man pages.
KInternet, cinternet, and qinternet can be used to control a local or remote
smpppd. cinternet is the command-line counterpart of the graphical
KInternet. qinternet is basically the same as KInternet, but does
not use the
KDE libraries, so it can be used without KDE and must be installed
separately. To prepare these utilities for use with a remote smpppd, edit
the configuration file /etc/smpppd-c.conf manually or
using KInternet. This file only uses three options:
list of sites
Here, tell the front-ends where to search for
smpppd. The front-ends test the options in the
order specified here. The local option orders the
establishment of a connection to the local
smpppd. gateway points to
an smpppd on the gateway. The connection
should be established as specified under
server in
config-file. slp orders the
front-ends to connect to an smpppd found via
SLP.
serverHere, specify the host on which smpppd runs.
passwordInsert the password selected for smpppd.
If smpppd is active, you can now try to access it, for example, with
cinternet --verbose --interface-list. If
you experience difficulties at this point, refer to the
smpppd-c.conf(5) and
cinternet(8) man pages.