Study Guide
Inspecting Network Configuration: Windows, Linux and VyOS
How to read a device's addresses, mask, gateway, DNS and routes: ipconfig /all on Windows, ip commands on Ubuntu, ifconfig on Linux lab machines, and show ip route on a VyOS router.
Lesson 3.14 Networking Fundamentals
Everything in this module becomes practical the moment you look at a device’s network settings. This lesson works out which settings matter, then reads them on Windows, on Linux (Ubuntu, Kali Linux and Metasploitable) and on a VyOS router, using the earlier lessons to judge whether they make sense.
Stage: Think
It will not connect
Think it through
A friend’s laptop can reach nothing on the internet. Before changing anything, which settings would you want to look at, and what would each one tell you?
- Hint 1: Think back through the module: what does a device need before it can talk to anything?
Show what happens
Its address and mask (which network it is on), its hardware address, its default gateway (the way out), its DNS servers (who looks up names) and whether DHCP set all this up. Every system shows the same few settings; only the commands differ.
Think it through
Show the answer
Answer: B. A wrong change can make it worse.
Reading configuration is safe and routine. A change made without understanding the problem can make it worse, and on a work system may not be authorised.
Stage: Explain
What you are looking for
Whatever the system, the same handful of settings explain most connection problems:
| Setting | Question it answers | Lesson |
|---|---|---|
| IP address and mask or prefix | Which network is this interface on? | Subnetting |
| MAC address | Which interface is this on the local link? | Ethernet switching |
| Default gateway | Where does traffic for other networks go? | Routing |
| DNS servers | Who turns names into addresses? | HTTPS, DNS and TLS |
| DHCP state | Were the settings assigned automatically? | DHCP and ARP |
Stage: Predict
Windows: ipconfig /all
On Windows, the command for finding a network card’s IP and MAC addresses is ipconfig /all, which lists every network adapter and its settings. The fields to recognise are:
| Field | What it tells you |
|---|---|
| Description | Which network adapter the section describes |
| Physical Address | The adapter’s MAC address |
| DHCP Enabled | Whether the address was assigned automatically |
| IPv4 Address | The device’s address on this network |
| Subnet Mask | Which part of the address is the network |
| Default Gateway | The next hop for other networks |
| DNS Servers | Where name lookups are sent |
An illustrative excerpt, written for this lesson and not captured from a real machine, looks like this:
Ethernet adapter Ethernet:
Description . . . . . . . . . . . : Example Gigabit Network Adapter
Physical Address. . . . . . . . . : 02-00-00-00-00-10
DHCP Enabled. . . . . . . . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.1.10(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.1.1Windows writes MAC addresses with hyphens rather than colons; 02-00-00-00-00-10 and 02:00:00:00:00:10 are the same address.
Think it through
Look at the excerpt. Using what you know about subnets, gateways and DHCP, is anything wrong with this configuration?
- Hint 1: Is the gateway on the same network as the address?
- Hint 2: Where did the settings come from?
Show what happens
No: the gateway is inside the device’s own network, the settings came from DHCP and the address is not a self-assigned one. The example checks each point in turn.
Use the ipconfig excerpt, and the skills from earlier lessons, to check it.
- Find the network. 192.168.1.10 with mask 255.255.255.0 is /24, so the network is 192.168.1.0/24 and the usable range is 192.168.1.1 to 192.168.1.254.
- Check the gateway. 192.168.1.1 is inside that range, so the device can reach its gateway directly. A gateway outside the device’s own network, such as 192.168.2.1, would be a misconfiguration.
- Check where the settings came from. DHCP Enabled is Yes, so these values came from a DHCP server. If the address had been in 169.254.0.0/16 instead, DHCP would have failed.
- Check name resolution. DNS goes to 192.168.1.1, the router, which is common on home and small-office networks.
Check your understanding
Show the answer
Answer: B. The gateway is not on the laptop’s network.
With a /24 mask the laptop’s network is 10.4.7.0/24, and 10.4.8.1 is outside it, so the laptop cannot reach its gateway directly.
Stage: Predict
Ubuntu: ip addr show
Think it through
Linux shows the same settings as Windows but labels them differently. In the output below, which label would you expect to show the hardware address, and which the IPv4 address?
- Hint 1: Look for a value in the hardware-address format, with colons.
Show what happens
link/ether shows the hardware address, and inet the IPv4 address with its prefix, as the notes under the output explain.
Linux shows the same five settings with different commands. Ubuntu is one widely used version of Linux, and the commands below work on most current ones.
On current Linux systems, including Ubuntu, the standard tools come from the iproute2 package. ip addr show, shortened to ip a, lists interfaces and their addresses. The older ifconfig command is a legacy tool. The output below is illustrative, written for this lesson and not captured from a real machine:
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 ...
link/ether 02:00:00:00:00:10 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.10/24 brd 192.168.1.255 scope global eth0link/ethershows the MAC address, andbrd ff:ff:ff:ff:ff:ffthe Ethernet broadcast address.inetshows the IPv4 address with its prefix, andbrd 192.168.1.255the subnet’s broadcast address.mtu 1500is the interface’s maximum transmission unit.
ip -4 route shows the routing table. Illustrative output:
default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.10The first line is the default gateway; the second is the directly connected network.
Stage: Explain
VyOS: show ip route
Routers have their own commands. VyOS is an open-source network operating system that can run as a virtual machine, and its show ip route command prints the routing table.
In the example used in this module, the table shows connected routes for 10.1.16.0/24 and 10.1.24.0/24, a /32 route and the 127.0.0.0/8 range on the loopback interface, and a static default route to 10.1.128.1 marked inactive.
Routing, default gateways and NAT/PAT reads the table line by line. An inactive default route means the router, in that state, had no working way to reach anything beyond its two connected networks.
Stage: Predict
Linux: ifconfig
ifconfig is an older Linux command for network interfaces. It can change their settings, but here it is used only to look at them. It answers three questions:
- which network interfaces does this machine have?
- which IPv4 address is on each one?
- are two machines on the same network?
Think it through
A machine has two network adapters, each with its own address. Someone asks “what is this machine’s IP address?” What is the problem with the question?
- Hint 1: How many addresses does the machine have?
Show what happens
There are two answers. The useful question is which interface is on the network you care about, and what its address is there.
Which interface matters?
A machine with more than one network adapter shows more than one interface, and each has its own address. Then “what is this machine’s IP address?” is the wrong question. The right one is “which of its interfaces is on the network I care about, and what is the address there?”
The setting for the example is a practice lab that is built in Virtual Machines, in Module 4. Two things about it are enough for now.
- The lab’s two computers are virtual machines: computers that exist as software inside an ordinary computer. One is used to do the testing and the other is the deliberately weak target.
- The testing machine has two adapters. One leads to the internet. The other joins a private network that exists only between the virtual machines, called a host-only network. The target has only the second kind.
Running ifconfig on the testing machine prints this. The output is illustrative, written for this lesson with invented addresses, and not captured from a real machine:
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.2.15 netmask 255.255.255.0 broadcast 10.0.2.255
ether 02:00:00:00:00:a1 txqueuelen 1000 (Ethernet)
eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.56.101 netmask 255.255.255.0 broadcast 192.168.56.255
ether 02:00:00:00:00:a2 txqueuelen 1000 (Ethernet)
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0Running it on the target shows one interface, with inet 192.168.56.102 netmask 255.255.255.0.
- Count the interfaces. The testing machine has three blocks:
eth0,eth1andlo. Setloaside: it is the loopback interface, the machine talking to itself. - Work out the network each one is on. A mask of
255.255.255.0means the first three numbers are the network. Soeth0(10.0.2.15) is on network10.0.2.0, andeth1(192.168.56.101) is on network192.168.56.0. - Do the same for the target.
192.168.56.102with the same mask is on network192.168.56.0. - Compare. The target’s network matches
eth1, noteth0. Soeth1is the testing machine’s interface on the lab network, andeth0is its route to the internet. - Read the flags. Both interfaces show
UPandRUNNING, so both are switched on and the system reports them as working.
The result: the two machines share the network 192.168.56.0/24 and can reach each other directly. The address to use for the target is 192.168.56.102, and the testing machine’s own lab address is 192.168.56.101, not 10.0.2.15.
What it does not show: that traffic actually gets through. ifconfig reports settings. Whether the two machines can really talk needs a test.
The exact layout varies between versions, so look for these labels rather than for fixed positions:
| Label | What it tells you |
|---|---|
| Interface name at the start of each block | Which interface the block describes; lo is the loopback interface |
inet (older versions: inet addr:) | The interface’s IPv4 address |
netmask (older versions: Mask:) | The subnet mask, which shows which part of the address is the network |
ether (older versions: HWaddr) | The interface’s MAC address |
UP and RUNNING flags | UP means the interface has been enabled. RUNNING means the operating system reports it as operational; on many interfaces that follows whether a link is detected, but it is not a direct link test and does not show that traffic will reach anywhere |
To check that two machines share a network, apply each one’s mask to its address and compare the network addresses, as in Subnetting.
ifconfig comes from the older net-tools package. On current Linux systems the standard tools come from iproute2, and ip addr shows the same interface and address information, as described in Ubuntu: ip addr show. Some systems no longer install ifconfig by default.
Check your understanding
Show the answer
Answer: B. No: it reports settings, not a test.
No. ifconfig reports settings; whether the machines can really talk needs a test.
Stage: Explain
Other useful commands
These complete the toolkit:
| Task | Windows | Linux |
|---|---|---|
| Show routes | route print -4 | ip -4 route |
| Show the ARP cache | arp -a | ip -4 neigh |
| Show addresses | ipconfig /all | ip addr show |
Reading configuration is safe and routine; changing it is not. On a work or lab system, stick to viewing commands unless you are authorised to make changes, and record what you saw before and after any change you are allowed to make.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
Show the answer
Answer: A. DNS Servers.
DNS Servers: addresses work, so only the step that turns names into addresses is failing.
Apply it
- Hint 1: Work out the block size in the third octet first.
Show the answer
Answer: C. 172.16.0.0/20
172.16.0.0/20: a /20 leaves four network bits in the third octet, so networks go up in blocks of 16, and 9 falls in the block from 0 to 15.
Apply it
Show the answer
Answer: B. Record what you saw and report it.
Record what you saw and report it. Reading configuration is within your permission; changing it, even to fix it, is not.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: The router has interfaces directly connected to 10.20.1.0/24 and 10.20.2.0/24.; The static default route is listed, but because it is inactive it is not in use.; 127.0.0.0/8 on lo is the loopback interface, not a link to another network.
The C lines are connected routes on the router’s own interfaces, so it is directly connected to 10.20.1.0/24 and 10.20.2.0/24. The lo entry is the loopback interface, not a link to another network. The S line is a static default route, and a route marked inactive is listed but not in use. The table alone cannot show why that route is inactive, so treating it as proof of misconfiguration goes beyond the evidence, and with its only default route inactive it does not show working internet access. The addresses here are illustrative.
Revision sources: Study Buddy — 23 September 2026 (Study Buddy session (supplementary)) · IP forwarding, default gateways and NAT/PAT (Supplementary Study Guide explanation)
Show answer
Answer: The MAC is 02-00-00-00-00-2B, the device is in 192.168.50.0/24 and other networks are reached via 192.168.50.1.
ipconfig /all shows an interface’s IP and MAC addresses. Reading the fields: Physical Address is the MAC address; the IPv4 address with mask 255.255.255.0 places the device in 192.168.50.0/24; the default gateway is the next hop for other networks; and DHCP Enabled: Yes means the adapter is configured to obtain its IPv4 configuration using DHCP, although that field alone does not prove every displayed setting came from DHCP. One device, such as a home router, can provide both the gateway and DNS, but they remain separate jobs. The output is illustrative.
Revision sources: Study Buddy — 23 September 2026 (Study Buddy session (supplementary)) · Inspecting Network Configuration: Windows, Linux and VyOS (Supplementary Study Guide explanation)
Show answer
Answer: To inspect each machine’s interfaces and identify their lab IPv4 addresses
ifconfig shows a machine’s own network interfaces and the IPv4 address on each one. Run on both machines, it identifies each machine’s lab address and confirms that both are on the intended lab network. It reports only the machine it is run on, so it does not find the services another machine exposes. Adapter modes are set in each VM’s VirtualBox configuration, not with ifconfig, and it gives no machine internet access.
Revision sources: Session 6: Networking Fundamentals — Part 2 (Classroom session record)
Show answer
Answer: The Host-only interface, which is attached to the same network as Metasploitable
A host-only network connects the host and the VMs attached to it, without ordinary internet access by itself. Metasploitable is attached only to that network, so Kali’s Host-only interface, on the same network, is the one that connects it to the lab; its NAT interface is on a different network. Kali does not pass traffic between its two networks unless forwarding is deliberately enabled and configured, so the interfaces are not interchangeable.
Revision sources: Virtual Machines (Supplementary Study Guide explanation)
Study and revision
Practise through the Networking & Protocols topic: questions on what an illustrative routing table does and does not show, and on reading ipconfig /all fields, plus a flashcard on default and inactive routes. The outputs are illustrative, written for this lesson. They are learning-only. Questions on what ifconfig is run for in a practice lab and on which of Kali’s interfaces connects it to the lab, and a flashcard on what ifconfig showed, are practised through the Security Architecture topic with the rest of the lab-topology material. They reproduce no addresses or output from a real machine.
Stage: Consolidate
What to remember
- The same few settings explain most connection problems: address and mask, MAC address, default gateway, DNS servers and DHCP state.
- Windows shows them with ipconfig /all; Linux with ip addr show and ip -4 route, or the older ifconfig.
- Check that the configuration makes sense: a gateway inside the device’s own network, and no 169.254 address.
- On a machine with several interfaces, find the one on the network you care about by comparing network addresses.
- Settings are not a test: a route or an up flag shows what should happen, not that traffic flows.
Key terms
- Routing table
A device’s list of destination networks and how to reach each one: through a directly connected interface or via a next-hop router.
- Default route
The route 0.0.0.0/0, which matches any IPv4 destination that has no more specific route. It points to the default gateway.
Common misunderstandings
An interface can have several addresses, including IPv4 and IPv6 at the same time.
Operating systems can change or randomise the MAC address in use, so the displayed address is the current setting.
A route shows where traffic would be sent. The VyOS default route was listed but inactive, so it was not in use.
Lesson sources and acknowledgements
Sources and scope
- From the Study Buddy session on 23 September (see the entry): Windows and Ubuntu demonstrations of finding an interface’s IP and MAC addresses, the
ipconfig /allcommand, and the VyOSshow ip routedemonstration with its routing table and start-up messages. The session was supplementary to the course, not a numbered classroom session. - Taught in Session 6 (see the entry): the tutor ran
ifconfigon Kali Linux and Metasploitable to view their interfaces, identify their IPv4 addresses and confirm they were on the intended lab network. - Not recorded: the exact Ubuntu command, the router’s interface addresses in the hand-drawn example, any ping result and the cause of the firewall configuration errors; and, for Session 6, the interface names, addresses and
ifconfigoutput. - Supplementary explanation: the settings overview, all example command output, the configuration check, the iproute2 commands, the command table, the practical note and the misunderstandings. In the ifconfig section, choosing the interface on the lab network, the illustrative two-interface output with its invented addresses and the five-step reading of it, the output labels and the comparison with
ip addrare also supplementary. During the 23 September demonstration the VyOS console also showed firewallconfigure failed!messages at start-up; their cause and any fix were not established. - Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the troubleshooting opening questions, every question asked in the lesson with its feedback and hints, the application questions and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. The Study Buddy and Session 6 material records demonstrations; I did not run the commands, configure VyOS or build the Session 6 lab.
A device’s store of recently learned IPv4-to-MAC address mappings, so it does not have to send an ARP request for every packet.
The last address of an IPv4 subnet, with all host bits set to 1. Traffic sent to it reaches every device in that subnet.
The next-hop router a device uses when no more specific route to a destination exists.
The route 0.0.0.0/0, which matches any IPv4 destination that has no more specific route. It points to the default gateway.
An application-layer protocol that automatically provides IP configuration, such as an address, subnet mask, default gateway and DNS server information.
The system that translates domain names into IP addresses. It commonly uses port 53 over UDP and TCP.
The standard way devices on a wired local network send data to each other, in units called frames that carry the MAC address of the sender and of the intended receiver.
A virtual network that connects a host computer and the virtual machines attached to it, without providing ordinary internet access by itself.
A logical network-layer address identifying an interface for delivery across networks. IPv4 addresses are 32 bits; IPv6 addresses are 128 bits.
An address a device uses to send traffic to itself, such as 127.0.0.1 in IPv4 or ::1 in IPv6.
A link-layer address used for local frame delivery, conventionally 48 bits written in hexadecimal. It may be randomised or spoofed, so it is not proof of identity.
The largest packet a link can carry without splitting it up. A typical Ethernet MTU is 1,500 bytes, not counting the Ethernet header and trailer.
The first address of a subnet, with all host bits set to 0. It identifies the network itself rather than any one device.
A group of eight bits, which can hold a value from 0 to 255. An IPv4 address is made of four octets.
The software that runs a computer and lets other programs use it. Windows, macOS, Linux, Android and iOS are operating systems.
A device that forwards traffic between networks, for example between a private local network and the internet.
A device’s list of destination networks and how to reach each one: through a directly connected interface or via a next-hop router.
One network within a larger set of networks: a group of IP addresses that share the same network part, so that devices in it can reach each other directly without a router.
A 32-bit value that marks which bits of an IPv4 address belong to the network (1s) and which belong to the host (0s), such as 255.255.255.0.
A software-defined computer with virtual hardware and its own guest operating system, running on resources supplied by a physical host.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.