# Linux Network Awareness and Interface Enumeration

> Enumerate Linux network interfaces, routing tables, active connections, and DNS config to map attack surface and identify lateral movement paths.

- **URL:** https://hackindex.io/platforms/linux/enumeration/network-awareness
- **Path:** Linux > Enumeration
- **Up:** [Enumeration](https://hackindex.io/platforms/linux/enumeration.md)
- **Published:** 2026-03-15
- **Updated:** 2026-08-11

Network enumeration from a shell maps the internal network the target lives on, identifies adjacent hosts, and exposes routing paths into otherwise unreachable segments. This is one of the first things to run after gaining access: the results directly feed lateral movement planning.

Key data points for linux network enumeration:

- Network interfaces and additional subnets
- Routing table entries revealing internal segments
- ARP cache for recently contacted hosts
- Active connections and locally listening services
- DNS configuration and internal domain names
- Firewall rules governing outbound and inbound traffic

## Enumerating Linux Network Interfaces

```bash
ip a
ip addr show
```

Look for interfaces beyond the one you connected through. Additional interfaces: `eth1`, `ens192`, `tun0`, `virbr0`, `docker0`: indicate the host is multi-homed or connected to additional network segments you cannot reach directly from your attacker machine.

```bash
cat /etc/network/interfaces 2>/dev/null
cat /etc/netplan/*.yaml 2>/dev/null
```

Static configuration files sometimes contain credentials or reveal the network architecture.

## Routing Table

```bash
ip route
ip route show table all
# default via 10.10.10.1 dev eth0
# 10.10.20.0/24 via 10.10.10.254 dev eth0
# 172.16.0.0/16 dev eth1 proto kernel scope link
```

Additional routes reveal internal subnets the host can reach. A `172.16.0.0/16` or `192.168.x.x` route that you cannot reach from outside means the target is your pivot point into that segment.

## ARP Cache

```bash
arp -a
ip neigh
```

The ARP cache shows hosts the target has recently communicated with: these are live, adjacent hosts. It is the fastest way to identify nearby targets without running a network scan.

## Active Connections

```bash
ss -tunap
netstat -tunap 2>/dev/null
# Netid  State   Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
# tcp    ESTAB   0       0       10.10.10.5:22        10.10.14.3:54132
# tcp    LISTEN  0       128     127.0.0.1:3306       0.0.0.0:*
# tcp    LISTEN  0       128     0.0.0.0:80           0.0.0.0:*
```

`LISTEN` entries on `127.0.0.1` are services only reachable locally: these are covered separately in [Locally Listening Services and Internal Ports](https://hackindex.io/platforms/linux/enumeration/locally-listening-services). `ESTABLISHED` connections show active sessions, which may include admin connections from other hosts worth noting.

## DNS Configuration

```bash
cat /etc/resolv.conf
cat /etc/hosts
```

`/etc/resolv.conf` reveals the internal DNS server IP: often a domain controller in Active Directory environments. The `search` and `domain` entries give the internal domain name.

`/etc/hosts` may contain entries for internal hosts that are not in DNS, or may reveal hostnames of adjacent services.

```bash
cat /etc/nsswitch.conf
```

Shows the resolver order. If `files` comes before `dns`, local `/etc/hosts` entries take priority: relevant for DNS-based lateral movement techniques.

## Firewall Rules

```bash
iptables -L -n -v 2>/dev/null
ip6tables -L -n -v 2>/dev/null
nft list ruleset 2>/dev/null
ufw status verbose 2>/dev/null
```

Firewall rules show what outbound and inbound traffic is permitted. This determines which ports and protocols are viable for reverse shells, data exfiltration, and lateral movement. If outbound is restricted, you need to match an allowed port or protocol.

## Network Scanning from the Host

When the host can reach internal subnets your attack machine cannot, use native tools to identify live hosts:

```bash
for i in $(seq 1 254); do (ping -c 1 -W 1 192.168.1.$i &>/dev/null && echo "192.168.1.$i up") & done; wait
```

Replace the subnet with the one identified from routing. This is noisy but fast when no other tools are available.

If `nmap` is installed:

```bash
nmap -sn 192.168.1.0/24 2>/dev/null
```

For port scanning a single internal host:

```bash
nmap -p- --min-rate 5000 192.168.1.x 2>/dev/null
```

## Wireless Interfaces

```bash
iwconfig 2>/dev/null
iw dev 2>/dev/null
```

If wireless interfaces are present, the host may be on a separate wireless network. Wireless-specific techniques are covered in the Wireless platform section.

## IPv6

```bash
ip -6 addr
ip -6 route
```

IPv6 is often misconfigured or overlooked. Link-local addresses (`fe80::`) exist on most modern interfaces even when IPv4 is the primary network. Internal services are sometimes reachable over IPv6 even when IPv4 firewall rules block them.