An advanced systems administration and networking series covering network bonding, firewalling, DNS resolution, enterprise storage, web services, and security hardening.
Link aggregation is the practice of combining multiple physical network interfaces into a single logical interface. The purpose is not to make a single file transfer faster—it cannot do that. The purpose is to increase aggregate throughput across many simultaneous flows, and to provide redundancy so that the failure of one cable does not sever…
The previous chapter established why link aggregation exists: to increase aggregate throughput across many flows and to provide redundancy when a link fails. This chapter is the operational counterpart. It examines the seven bonding modes in detail, the parameters that control failover timing, and the configuration syntax for both the running kernel and persistent network…
A VLAN is a logical subdivision of a physical LAN. It allows a single switch, or a single Linux host acting as a switch, to present multiple isolated broadcast domains over the same physical infrastructure. Devices in one VLAN cannot reach devices in another VLAN at Layer 2, even if they are connected to the…
The previous chapter established the concepts: VLAN tags are four-byte headers that separate broadcast domains on a shared physical link, and Linux presents each VLAN as a virtual interface. This chapter is the configuration sequence. It covers the kernel module that provides 802.1Q support, the ip link commands that create and verify VLAN interfaces, the…
A network namespace is a logical copy of the kernel’s network stack. It has its own network interfaces, its own routing table, its own firewall rules, and its own set of sockets . Processes inside one network namespace cannot see or communicate with the network resources of another namespace unless a virtual link explicitly connects…
The previous chapter established the concepts: a network namespace is a logical copy of the kernel network stack, isolated from the default namespace and from every other namespace. This chapter is the practical application. It covers the four patterns that account for nearly every real-world use of network namespaces: connecting two namespaces with a veth…
TUN and TAP are virtual network kernel drivers that move packets between the kernel’s network stack and a userspace program. They are not physical interfaces, but they appear to the kernel as if they were, and they can be assigned IP addresses, added to routes, and used by any application that opens a socket. The…
A veth pair is a virtual Ethernet cable with exactly two ends. A packet transmitted on one end is immediately received on the other. This simplicity is the entire mechanism, and it is also the reason veth pairs are the foundation of every modern Linux virtualization and container network. Unlike a TUN or TAP device,…
MACVLAN and IPVLAN are two virtual network drivers that solve a problem veth pairs and bridges cannot: they allow a single physical interface to present multiple distinct network identities without creating a bridge. A MACVLAN interface gets its own MAC address, so the external switch sees it as a separate physical host. An IPVLAN interface…
An overlay network is a virtual network built on top of an existing physical network. The physical network, called the underlay, provides basic IP connectivity between hosts. The overlay creates a separate logical topology on top of it, encapsulating one type of packet inside another so that the underlay only sees the outer headers. The…