Networking

7 min read

Start with net status to see whether an interface has joined a network, which profile it uses, and whether it has an address and a default route. On the desktop, open Network Manager from the launcher by typing network.

net status
resolv status

net reports interface configuration; resolv reports the name servers actually in use. For a firewall change, an administrator also checks net policy. A route, a DNS answer and permission to reach a service are separate checks.

Choose the next check #

The net command reference explains its output and access rights. The diagnostic tools guide covers probes available in Experimental.

The registry is the truth #

Network settings live under Machine\System\Network. Change them through Network Manager or the profile and rule keys. netd reads those settings and applies them live; there is no interface configuration file or reload command.

Do not add an address by hand to a joined interface: netd removes addresses that its profile does not request. Routes added by another program are left alone unless they carry netd's own routing-protocol tag. The kernel's IPv6 link-local address is left alone too. The exact ownership and apply order are in Reconciliation.

The netd loop and startup and restart chapters describe how registry, kernel, lease and timer changes are reconciled.

Rules say which, profiles say how #

A rule under Rules\Interface selects an interface and gives it one of three outcomes:

• JOIN(profile) uses a profile under Profiles\.
• IGNORE leaves the interface as it is, including existing settings.
• DOWN keeps the interface administratively down.

A profile supplies settings such as Address.Static, Route.Gateway and Dns.Servers. Each Offered value decides whether to accept that part of the network's offer. An offer is a claim from the network, not proof that it is trustworthy. A child profile inherits its parents' settings and replaces only the values it names.

A profile can serve several interfaces at once; there is no separate activation step. Rules can match stable interface identity or the network's name and trust label. A shipped wired rule at priority 10 assigns all wired interfaces to default, which accepts offered addresses, routes and DNS and enables link-local fallback. A bare profile accepts none of those offers. No matching rule means IGNORE.

See Configuring profiles for examples and Network policy for exceptions, priorities and conflicts.

The inventory and the networks #

Use net status for the current link, address, lease and network. The interface id remains stable for the same card in the same slot even if its kernel name changes across boots.

The registry also keeps records under Interfaces\<id> and Networks\<id>. netd's findings are in their protected Status subkeys; hand edits there are refused. On a network record, you can set Name and Trust. Rules for both profiles and the firewall use those labels, so changing one can change connectivity.

Network identification currently uses the DHCP server and subnet, or an advertising router and prefix. It does not prove a network's identity. The inventory and network records chapters list the persisted fields; lease timers and current offered configuration are live daemon state, not a lease to restore from the registry.

Addresses #

Choose these in a profile, then check the result in net status:

An expired DHCP lease is dropped by default. Address.OnExpiry = Keep trades address-conflict risk for continuity. A network's RequestedAddress is only the address to ask for first next time; the server can refuse it.

A deprecated IPv6 address remains for existing connections but is not chosen for new ones; it is removed when its valid lifetime ends. Stable address derivation, temporary-address rotation and the protective two-hour lifetime rule are documented in IPv6 addresses. See DHCPv4 for acquisition, renewal and fallback details.

Readiness is a level, not a boolean #

The machine reports the highest level among joined interfaces. Readiness is also published on Machine\System\Network and each joined interface's Status for scripts and services.

net wait routed waits for a default route. A service may declare Requires = ["network:routed"]. These waits differ: net wait accepts at least the requested level, while peinit matches the published service level exactly. See Readiness before depending on network:addressed.

What netd does not do #

• Answer DNS. resolvd receives netd's live server and domain information; use name resolution to configure and diagnose it. netd writes neither /etc/resolv.conf nor /etc/hosts.
• Filter traffic. The kernel enforces PNP's packet layers. DHCP and router-discovery traffic need the baseline's visible, deletable rules.
• Grant port ownership. Port reservations decide who may bind a port; the firewall decides who may reach it.
• Associate Wi-Fi. A supplicant must bring up a wireless link before netd can configure it. Wi-Fi is unfinished: wireless is absent from the baseline, Network Manager shows it as Not managed, and wireless networks are not yet identified by name.

Where to start #

• Configure a profile, apply it through a matching rule, and read back the accepted settings.
• Use Network Manager for desktop configuration, change previews and its documented rollback flow.
• Troubleshoot a symptom.
• Look up exact settings in regman 'Machine\System\Network' or the network policy reference.
• Use the netd technical reference manual for daemon algorithms, protocol exchanges, timers and limits.

Edit this page