CUNP key terms

A filesystem data structure that stores a file's metadata, such as permissions, ownership, size, and pointers to data blocks, but not its name. Directories map names to inode numbers.

An additional directory entry pointing to the same inode as an existing file. All links share content and metadata; the data is removed only when the last link is deleted.

A special file containing a pathname that the kernel resolves when accessed. It can cross filesystems and can dangle if the target is removed, unlike a hard link.

A small non-negative integer a process uses to refer to an open file, socket, or pipe. Descriptors 0, 1, and 2 are conventionally standard input, output, and error.

An asynchronous notification delivered to a process, such as SIGTERM or SIGHUP, that interrupts normal execution. Handlers may catch most signals, but SIGKILL and SIGSTOP cannot be caught or ignored.

A long-running background process detached from a controlling terminal that provides a service, such as sshd or named. Modern systems usually start daemons under a service manager rather than self-daemonizing.

A declarative configuration file describing a service, socket, timer, or mount that systemd manages. Unit files define dependencies, start commands, restart behavior, and sandboxing options.

A technique where the service manager binds a listening socket and passes it to a service on first connection, letting the service start on demand and restart without dropping queued connections.

A seven-layer reference framework describing network functions from physical signaling up to application services. It is a teaching and diagnostic model; real TCP/IP stacks do not map cleanly onto all seven layers.

The process of wrapping data in successive protocol headers as it moves down the stack, so each layer adds its own control information before transmission and strips it on receipt.

Maximum transmission unit, the largest payload a link can carry in one frame, typically 1500 bytes on Ethernet. Mismatched MTU along a path causes fragmentation or silently dropped large packets.

Splitting an IP datagram into smaller pieces so it fits a link's MTU. IPv4 routers may fragment; IPv6 routers do not, leaving fragmentation to the sender.

A mechanism that determines the smallest MTU along a path by setting the don't-fragment flag and relying on ICMP 'fragmentation needed' messages. Blocked ICMP breaks it and causes connectivity stalls.

The TCP connection setup exchange: the client sends SYN, the server replies SYN-ACK, and the client sends ACK. It synchronizes sequence numbers and confirms both directions are reachable.

The queue of completed or pending connections a listening socket will hold before the kernel refuses or drops new SYNs. Too small a backlog causes connection timeouts under load.

One of the defined phases of a TCP connection, such as ESTABLISHED, TIME_WAIT, or CLOSE_WAIT. Inspecting states reveals hung applications, half-closed connections, and port exhaustion.

A connectionless transport protocol that sends datagrams without handshakes, ordering, or retransmission. Applications such as DNS and streaming add their own reliability where needed.

A 16-bit number identifying a service endpoint within a host's IP address. Servers listen on well-known or registered ports while clients use ephemeral source ports.

An operating system endpoint for network communication, identified by protocol, local address and port, and often remote address and port. Applications read and write sockets through file descriptors.

A compact way to write an IP network and its prefix length, such as 192.0.2.0/24. The prefix length gives the number of leading network bits and determines the address range and host count.

A bit pattern that separates the network portion of an IPv4 address from the host portion. It is the dotted-decimal equivalent of a CIDR prefix length.

The modern Linux utility from iproute2 for inspecting and changing addresses, links, and routes. It replaces legacy tools such as ifconfig and route on current distributions.

A Linux kernel isolation feature giving a process its own set of interfaces, addresses, routes, and firewall rules. Containers commonly rely on namespaces plus virtual Ethernet pairs.

A virtual Ethernet device pair whose two ends are linked: a frame sent into one end emerges from the other. Veth pairs connect namespaces or bridges to the host network.

A software switch that forwards frames between attached interfaces based on MAC addresses. Linux bridges commonly join virtual machines or containers to a physical uplink.

Address Resolution Protocol maps an IPv4 address to a link-layer MAC address on the local segment. Neighbor caches store results, and stale or spoofed entries cause connectivity or security problems.

Neighbor Discovery Protocol performs address resolution, router discovery, and duplicate address detection for IPv6 using ICMPv6. It replaces ARP and parts of ICMP router discovery in IPv4.

Internet Control Message Protocol carries error and diagnostic messages between hosts and routers, such as destination unreachable and echo request. Firewalls must permit selected ICMP types for correct operation.

The kernel's list of destination prefixes with next hops, interfaces, and metrics used to choose where to send each packet. The most specific matching prefix wins.

The router to which packets are sent when no more specific route matches the destination. Without a working default route, a host can reach only directly connected networks.

Selecting routes using rules beyond destination address, such as source address, mark, or incoming interface. Linux implements it with ip rule and multiple routing tables.

The Linux kernel framework providing packet filtering, NAT, and connection tracking hooks. Userspace tools such as iptables and nftables configure rules that netfilter evaluates.

The current Linux packet-filtering subsystem and userspace tool, replacing iptables. It uses tables, chains, and rules with a unified syntax and supports sets and maps for efficient matching.

The netfilter feature that records the state of flows so rules can match on NEW, ESTABLISHED, or RELATED rather than only addresses and ports. It also underpins stateful NAT.

Network Address Translation rewrites addresses or ports as packets pass a router, letting many hosts share a public address. It complicates inbound connections and protocols that embed addresses.

Deliberately delaying or queuing packets to keep transmission within a rate limit and smooth bursts. Linux implements it with queueing disciplines such as tbf and htb attached to interfaces.

A login method where the client proves possession of a private key matching an authorized public key on the server. It avoids sending passwords and is preferred over password login.

Pluggable Authentication Modules, a framework of stacked modules that services such as sshd and login consult for authentication, account, session, and password checks. Misordered stacks can lock out access.

A program that runs commands as another user, usually root, according to policy in sudoers. Rules can be limited by user, host, command, and options, and every use is logged.

A signed data structure binding a public key to an identity, used to authenticate servers and optionally clients. Validation checks the chain to a trusted root, validity dates, and name match.

Server Name Indication, a TLS extension in which the client sends the requested hostname before the handshake completes, letting one address serve many certificates.

A command-line packet capture tool that writes or displays traffic matching a filter expression. Captures are often saved as pcap files for analysis in Wireshark.

A utility that sends ICMP echo requests and reports round-trip times and loss. Failure may indicate a dead host, a blocked ICMP type, or a routing problem rather than a down host.

A tool that reveals the path to a destination by sending packets with increasing time-to-live values and collecting the resulting ICMP errors. Blocked responses appear as missing hops.

A chain of commands where the standard output of one becomes the standard input of the next, joined by the pipe operator. Each stage runs concurrently as a separate process.

A bash feature that presents a command's output or input as a temporary filename, written as <(command) or >(command), so tools expecting files can consume streams.

The integer a process returns to its parent when it finishes, where zero conventionally means success. Shells expose it as $? and use it to drive conditional logic.

A shell option that makes a script exit when a simple command fails. Its interaction with pipelines, conditionals, and command substitution is subtle, so many scripts add pipefail deliberately.