ifconfig / ip addr

ip addr (alias ip a) lists interfaces and the addresses attached to them. ip link shows layer-2 state (UP/DOWN, MAC). ip route shows how packets leave. Together they replaced the old ifconfig/route/netstat split. On modern Ubuntu and Kali, ip is almost always present. Learn to skim for: interface name, state UP, inet line with CIDR, and the lo block.

ifconfig prints a similar story in a different layout: iface name, HWaddr (MAC), inet addr, Mask, flags like UP RUNNING. On a minimal Ubuntu or Kali it may be missing until you install net-tools. Missing ifconfig is not a broken network — it is a missing legacy binary. When an exam still says ifconfig, translate: they want the IPv4, the mask or CIDR, and whether the link is up. Do not spend energy fighting tools; map fields between the two outputs.

Useful companions: hostname -I often prints addresses in a short list; ip -br a is a compact table (if supported). None of these commands authorize scanning other people. They inventory this host. Save the output under $HOME/cyberlium-lab so you can compare before/after VPN or before/after a VM network mode change.

An interface is a named door: lo, eth0, ens33, enp0s3, wlan0, wlp2s0, tun0, wg0, docker0, virbr0. The name hints at the path (virtual machine NIC, Wi-Fi, VPN, container bridge). State UP means the door is open; DOWN means no link or someone disabled it. A VM on "NAT" versus "bridged" changes which private address you see — that is why classmates get different 192.168.x.y numbers for the same lab sheet.

IPv4 appears as inet 192.168.1.50/24. The /24 is CIDR: 24 bits of network, 8 bits of host — 256 addresses in the subnet, one of which is this host (and some reserved). Older ifconfig shows Mask 255.255.255.0 for the same idea. IPv6 shows as inet6 with a longer prefix. You can ignore advanced routing for now; you must not confuse MAC and IP. The MAC (link/ether) is the hardware-ish address on the LAN segment; the IP is the layer-3 address used for routing.

lo (loopback) is 127.0.0.1 (and ::1). It is how the machine talks to itself without leaving the host. Services bound only to 127.0.0.1 are not reachable from other computers — a critical distinction when you later read ss/netstat. If lo is missing or down, something is deeply wrong with the stack. Private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are normal on home labs and NAT VMs; they are not "public internet addresses" you should announce as globally unique.

Start with: which interface is UP besides lo? What is its inet address? Is there a second inet on a VPN tunnel? When SSH from a host to a guest fails, first confirm the guest's IP with ip a inside the guest — not by guessing from last week's screenshot. When a web app "works on my machine," check whether it bound to 127.0.0.1 only.

Scope rule for Cyberlium: inventory your own NICs. Do not change other people's interfaces. Do not run discovery sweeps against campus networks. Do not treat a coffee-shop Wi-Fi as your playground. Lab network practice stays on your VM, WSL, or gear you own and are allowed to configure.

Optional depth: ip route show default reveals the gateway; without a default route you may have a link address but no path off the LAN. That matters for later ping/traceroute lessons. Still: diagnose YOUR box first.

Create a lab folder, dump ip addr and ip route, and write two lines in plain language: your primary IPv4 and that 127.0.0.1 is loopback. If ifconfig exists, capture it too and map Mask to CIDR mentally. No scanning. No sudo required for reading addresses in the common case.

# YOUR machine only — read addresses; do not scan others
mkdir -p "$HOME/cyberlium-lab/m04-ip"
cd "$HOME/cyberlium-lab/m04-ip" || exit 1

# Modern toolkit (preferred)
ip addr > ip-addr.txt
ip -br a > ip-br.txt 2>/dev/null || true
ip link > ip-link.txt
ip route > ip-route.txt

# Optional legacy tool (may need: sudo apt install net-tools — on YOUR box)
if command -v ifconfig >/dev/null 2>&1; then
  ifconfig -a > ifconfig.txt
else
  echo "ifconfig not installed (normal on minimal systems)" > ifconfig.txt
fi

# Quick human notes
{
  echo "Primary IPv4 (fill in after reading ip-addr.txt):"
  echo "Loopback is 127.0.0.1 on lo"
  echo "MAC is NOT an IP — do not confuse ether with inet"
} > notes.txt

# Peek
echo '--- ip -br a ---'
ip -br a 2>/dev/null || ip addr
echo '--- default route ---'
ip route | head -n 20
cat notes.txt

# NEVER:
# nmap the campus network because you saw a gateway
# ip link set lo down on a shared host
# "practice" by changing someone else's router
# treat classmates' private IPs as attack targets

You can inventory interfaces with ip (and read ifconfig when it appears), separate MAC from IP, explain CIDR briefly, and treat loopback as self-talk. Next — ping, traceroute, netstat — tests reachability and listening sockets on systems you own.