Skip to content
HackIndex logo

HackIndex

Linux Network Awareness and Interface Enumeration

3 min read Mar 15, 2026

Network enumeration from a shell maps the internal network the target lives on, identifies adjacent hosts, and exposes routing paths into otherwise unreachable segments. This is one of the first things to run after gaining access — the results directly feed lateral movement planning.

Network Interfaces

user@host ~ $ ip a
user@host ~ $ ip addr show

Look for interfaces beyond the one you connected through. Additional interfaces — eth1, ens192, tun0, virbr0, docker0 — indicate the host is multi-homed or connected to additional network segments you cannot reach directly from your attacker machine.

user@host ~ $ cat /etc/network/interfaces 2>/dev/null
user@host ~ $ cat /etc/netplan/*.yaml 2>/dev/null

Static configuration files sometimes contain credentials or reveal the network architecture.

Routing Table

user@host ~ $ ip route
user@host ~ $ ip route show table all 
default via 10.10.10.1 dev eth0
10.10.20.0/24 via 10.10.10.254 dev eth0
172.16.0.0/16 dev eth1 proto kernel scope link

Additional routes reveal internal subnets the host can reach. A 172.16.0.0/16 or 192.168.x.x route that you cannot reach from outside means the target is your pivot point into that segment.

ARP Cache

user@host ~ $ arp -a
user@host ~ $ ip neigh

The ARP cache shows hosts the target has recently communicated with — these are live, adjacent hosts. It is the fastest way to identify nearby targets without running a network scan.

Active Connections

┌──(kali㉿kali)-[~]
└─$ ss -tunap
┌──(kali㉿kali)-[~]
└─$ netstat -tunap 2>/dev/null 
Netid  State   Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
tcp    ESTAB   0       0       10.10.10.5:22        10.10.14.3:54132
tcp    LISTEN  0       128     127.0.0.1:3306       0.0.0.0:*
tcp    LISTEN  0       128     0.0.0.0:80           0.0.0.0:*

LISTEN entries on 127.0.0.1 are services only reachable locally — these are covered separately in Locally Listening Services and Internal Ports. ESTABLISHED connections show active sessions, which may include admin connections from other hosts worth noting.

DNS Configuration

┌──(kali㉿kali)-[~]
└─$ cat /etc/resolv.conf
┌──(kali㉿kali)-[~]
└─$ cat /etc/hosts

/etc/resolv.conf reveals the internal DNS server IP — often a domain controller in Active Directory environments. The search and domain entries give the internal domain name.

/etc/hosts may contain entries for internal hosts that are not in DNS, or may reveal hostnames of adjacent services.

┌──(kali㉿kali)-[~]
└─$ cat /etc/nsswitch.conf

Shows the resolver order. If files comes before dns, local /etc/hosts entries take priority — relevant for DNS-based lateral movement techniques.

Firewall Rules

┌──(kali㉿kali)-[~]
└─$ iptables -L -n -v 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ip6tables -L -n -v 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ nft list ruleset 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ufw status verbose 2>/dev/null

Firewall rules show what outbound and inbound traffic is permitted. This determines which ports and protocols are viable for reverse shells, data exfiltration, and lateral movement. If outbound is restricted, you need to match an allowed port or protocol.

Network Scanning from the Host

When the host can reach internal subnets your attack machine cannot, use native tools to identify live hosts:

┌──(kali㉿kali)-[~]
└─$ for i in $(seq 1 254); do (ping -c 1 -W 1 192.168.1.$i &>/dev/null && echo "192.168.1.$i up") & done; wait

Replace the subnet with the one identified from routing. This is noisy but fast when no other tools are available.

If nmap is installed:

┌──(kali㉿kali)-[~]
└─$ nmap -sn 192.168.1.0/24 2>/dev/null

For port scanning a single internal host:

┌──(kali㉿kali)-[~]
└─$ nmap -p- --min-rate 5000 192.168.1.x 2>/dev/null

Wireless Interfaces

┌──(kali㉿kali)-[~]
└─$ iwconfig 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ iw dev 2>/dev/null

If wireless interfaces are present, the host may be on a separate wireless network. Wireless-specific techniques are covered in the Wireless platform section.

IPv6

┌──(kali㉿kali)-[~]
└─$ ip -6 addr
┌──(kali㉿kali)-[~]
└─$ ip -6 route

IPv6 is often misconfigured or overlooked. Link-local addresses (fe80::) exist on most modern interfaces even when IPv4 is the primary network. Internal services are sometimes reachable over IPv6 even when IPv4 firewall rules block them.