> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/linux/network-enumeration.md).

# Network Enumeration

Enumerating Network Configuration can expose internal interfaces, routing, services, DNS details, and hidden network information, which are crucial for lateral movement or tunneling.

***

### Interface and IP Information

Check active and inactive interfaces, including IP addresses:

```bash
ifconfig
```

```
ifconfig -a
```

* Preferred modern alternative

```
ip a
```

```
ip addr
```

{% hint style="info" %}
If the machine has multiple IPs/interfaces, try to spawn a shell through other interfaces. It may help bypass egress firewall rules.
{% endhint %}

***

### Network Configuration Files

These files store static IP, DNS, and gateway settings:

* Debian/Ubuntu

```bash
cat /etc/network/interfaces 
```

* RHEL/CentOS

```
cat /etc/sysconfig/network
```

* RHEL/CentOS (e.g., ifcfg-eth0 or ifcfg-enp0s3)

```
cat /etc/sysconfig/network-scripts/ifcfg-<iface>
```

* DNS server entries

```
cat /etc/resolv.conf
```

***

### Routing Table

Identify default gateways, routes to internal subnets:

```bash
route -n
```

```
/sbin/route -n
```

```
ip route
```

***

### Neighbor Discovery

Useful to find connected hosts and ARP cache:

```bash
arp -a
```

```
ip neigh
```

***

### Traceroute & Tracepath

Understand network hops between the target and attacker:

```bash
traceroute <your-ip>
```

```
tracepath <your-ip>
```

***

### Open Ports & Listening Services

Check which services are running and bound to which interfaces:

```bash
netstat -nltup
```

* alternative to netstat

```
ss -nltup
```

{% hint style="success" %}
Look for services listening on `0.0.0.0` or internal IPs `127.0.0.1` that may not be exposed externally. If it's run on an internal IP, then we need to create a tunnel.
{% endhint %}