CUNP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

SIGKILL vs SIGTERM

SIGTERM (15) requests graceful shutdown and can be caught or ignored. SIGKILL (9) is handled by the kernel, cannot be caught, and terminates immediately without cleanup.

Hard link vs symlink

A hard link is another directory entry pointing to the same inode, so data persists until the last link is removed. A symlink stores a path string and breaks if its target is deleted.

Load average meaning

The average count of tasks in runnable or uninterruptible sleep state over 1, 5, and 15 minutes. Compare it to the CPU count; values above that indicate saturation or blocked I/O.

Redirection order 2>&1

The shell processes redirections left to right. `cmd >file 2>&1` sends both streams to file, while `cmd 2>&1 >file` sends stderr to the original stdout and stdout to the file.

TCP three-way handshake

The client sends SYN with an initial sequence number, the server replies SYN-ACK acknowledging it and sending its own, and the client sends ACK. The connection is then ESTABLISHED.

TIME_WAIT purpose

The side that closes first waits twice the maximum segment lifetime, commonly 60 seconds on Linux, so late duplicate segments expire and the final ACK can be retransmitted if lost.

TCP MSS calculation

MSS equals MTU minus the IP header minus the TCP header. On a 1500-byte Ethernet MTU with IPv4, that is 1500 minus 20 minus 20, giving 1460 bytes.

ICMP fragmentation needed

ICMP type 3 code 4 reports that a packet exceeded a link MTU while the Don't Fragment bit was set. Path MTU discovery depends on receiving it to lower the sender's packet size.

iproute2 address and route

`ip addr add 192.0.2.10/24 dev eth0` assigns an address, `ip link set eth0 up` enables the interface, and `ip route add default via 192.0.2.1` installs the default gateway.

VLAN subinterface creation

`ip link add link eth0 name eth0.100 type vlan id 100` creates a tagged subinterface on eth0 for VLAN 100. Bring it up and assign an address like any other interface.

Bonding mode active-backup

Bonding mode 1 keeps one slave active and the others as hot standbys. Failover occurs when the active link fails; no switch configuration or link aggregation is required.

ip neigh neighbor cache

`ip neigh` lists the ARP and NDP cache, showing entries as REACHABLE, STALE, DELAY, PROBE, or FAILED. FAILED entries indicate unresolved address resolution for that next hop.

ss listening sockets

`ss -lntup` shows listening TCP and UDP sockets with numeric ports, the bound address, and the owning process. The -p flag needs privilege to reveal other users' processes.

systemd socket activation

A .socket unit binds the port and holds the file descriptor. When traffic arrives, systemd starts the paired .service and passes the listening socket, enabling on-demand daemon startup.

DHCP DORA sequence

The client broadcasts Discover, servers reply Offer, the client sends Request for one offer, and the server confirms with Ack. Address, gateway, DNS, and lease time arrive in the Ack.

DNS CNAME restriction

A CNAME record maps a name to another name and cannot coexist with any other record type at the same owner name. Use A or AAAA records directly at zone apexes.

Longest prefix match rule

When multiple routes match a destination, the most specific prefix wins regardless of metric. Metrics only break ties between routes with identical prefix length and administrative distance.

Netfilter hook traversal order

Locally destined packets traverse prerouting then input. Forwarded packets traverse prerouting, forward, postrouting. Locally generated packets traverse output then postrouting.

SNAT vs DNAT placement

Source NAT and masquerade rewrite the source address in the postrouting hook. Destination NAT rewrites the destination address in prerouting, before the routing decision is made.

netem qdisc purpose

The netem queueing discipline injects controlled delay, jitter, packet loss, duplication, and reordering on an interface, allowing reproducible tests of how protocols behave on impaired links.

TLS 1.3 handshake gain

TLS 1.3 completes in one round trip and mandates ephemeral key exchange such as ECDHE, providing forward secrecy. It also removes legacy ciphers and encrypts more of the handshake.

SSH public key authentication

The client proves possession of its private key by signing a session-specific challenge. The server verifies the signature against a matching public key in the account's authorized_keys file.

SELinux enforcing vs permissive

Enforcing blocks and logs policy violations. Permissive logs violations without blocking, which is used to generate policy during troubleshooting. Disabled turns the subsystem off entirely.

umask 027 result

A umask of 027 masks group write and all other permissions. New files get 640 and new directories get 750, assuming the creating program requested 666 or 777 respectively.

PAM control flag sufficient

If a module with the sufficient flag succeeds, PAM returns success immediately without running later modules. If it fails, evaluation continues with the remaining stack entries.

tcpdump BPF filter syntax

A capture filter such as `tcp port 443 and host 203.0.113.5` is compiled into BPF and applied in the kernel. `-w` writes a pcap file and `-s 0` captures full frames.

ss -ti socket details

The -i flag prints internal TCP information per socket, including smoothed round-trip time, congestion window, retransmit counters, and retransmission timeout, which reveal loss and congestion.

Latency versus throughput

Latency is the round-trip time for a packet, measured by ping. Throughput is the sustained data rate, measured by iperf3. High throughput can coexist with high latency on long fat networks.

traceroute star hops

An asterisk means no ICMP time-exceeded reply arrived within the timeout. Routers or firewalls commonly filter such replies, so stars do not prove that the path is broken.

set -euo pipefail

This header makes bash exit on any unset variable, on any command returning nonzero, and on any failing command inside a pipeline, rather than only the last one.

getopts OPTARG and OPTIND

getopts parses short options in a loop, storing the option letter in the named variable and its argument in OPTARG. OPTIND tracks the next argument index to process.

Exit code 127

Exit status 127 means the shell could not find the command to execute. Status 126 means the file was found but is not executable, and 128 plus N indicates death by signal N.