The Ultimate Guide to nmcli: Linux Network Management & Security

The Ultimate Guide to nmcli: Linux Network Management & Security

The Ultimate Guide to nmcli: Linux Network Management & Security

nmcli (NetworkManager Command Line Interface) is a powerful tool that allows users to configure and manage network connections on Linux without relying on a graphical user interface. Whether you're working on a server, scripting network automation, or troubleshooting connectivity issues, nmcli provides a flexible and efficient way to interact with NetworkManager.

By thowfick official

1. Basic Usage Format

nmcli [OPTIONS] OBJECT { COMMAND | help }

• OBJECT: Defines what to manage (e.g., device, connection, wifi, networking, etc.).
• COMMAND: Specifies the action to perform (e.g., show, up, down, list, etc.).

2. What You Can Do with nmcli

1️⃣ Show Network Status

nmcli general status

• Displays overall network status, including whether connectivity is enabled or disabled.

2️⃣ List Network Devices

nmcli device status

• Shows all network interfaces (Wi-Fi, Ethernet, etc.) and their current state.

nmcli device show

• Provides detailed information about all network interfaces.

3️⃣ Enable/Disable Networking

nmcli networking off  # Disable networking
nmcli networking on   # Enable networking

4️⃣ Manage Wi-Fi Networks

📌 List available Wi-Fi networks

nmcli dev wifi list

📌 Connect to a Wi-Fi network

nmcli dev wifi connect "WiFi-SSID" password "WiFi-Password"

📌 Connect using a saved profile

nmcli con up "WiFi-SSID"

📌 Disconnect from Wi-Fi

nmcli dev disconnect wlan0

5️⃣ Manage Network Connections

📌 Show all saved connections

nmcli connection show

📌 Show details of a specific connection

nmcli connection show "WiFi-SSID"

📌 Delete a saved connection

nmcli connection delete "WiFi-SSID"

6️⃣ Configure Static IP (Manual IP Address)

nmcli connection modify "eth0" ipv4.addresses "192.168.1.100/24"
nmcli connection modify "eth0" ipv4.gateway "192.168.1.1"
nmcli connection modify "eth0" ipv4.dns "8.8.8.8,8.8.4.4"
nmcli connection modify "eth0" ipv4.method manual
nmcli connection up "eth0"

• Sets a static IP address, gateway, and DNS.

7️⃣ Set Up a Wi-Fi Hotspot

nmcli device wifi hotspot ifname wlan0 ssid MyHotspot password "12345678"

• Turns your Linux device into a Wi-Fi hotspot.

8️⃣ Restart NetworkManager

nmcli networking off && nmcli networking on

• Restarts network services without requiring a full system reboot.

9️⃣ Enable/Disable Network Interfaces

nmcli device disconnect eth0  # Disable Ethernet
nmcli device connect eth0     # Enable Ethernet

🔟 Control Airplane Mode & Wi-Fi/Bluetooth Radios

nmcli radio wifi off       # Disable Wi-Fi
nmcli radio wifi on        # Enable Wi-Fi
nmcli radio all off        # Enable Airplane mode
nmcli radio bluetooth off  # Disable Bluetooth

4. Using nmcli for Hacking & Penetration Testing

📌 Scan for Nearby Wi-Fi Networks and Hidden SSIDs

nmcli dev wifi rescan && nmcli dev wifi list

• Forces a Wi-Fi scan and lists all available networks, including hidden ones.

📌 Connect to a Hidden SSID

nmcli connection add type wifi con-name HiddenSSID ifname wlan0 ssid "HiddenSSID"
nmcli connection modify HiddenSSID wifi-hidden yes
nmcli connection up HiddenSSID

• Connects to a hidden Wi-Fi network that is not broadcasting its SSID.

📌 Deauthenticate a Target Device (Requires Additional Tools)

nmcli dev disconnect wlan0

• Disconnects your device from the network, which can be useful for testing re-authentication vulnerabilities.

📌 MAC Address Spoofing for Anonymity

nmcli connection modify "WiFi-SSID" 802-11-wireless.cloned-mac-address random

• Randomizes the MAC address to prevent tracking and bypass MAC filtering.

📌 Force DHCP Lease Renewal to Obtain a New IP

nmcli device disconnect eth0 && nmcli device connect eth0

• Forces the DHCP client to request a new IP address from the router.

📌 Test Internet Connectivity & Network Redirection

nmcli networking connectivity check

• Checks if the system has internet access, which is useful for detecting captive portals or firewalls.

📌 Identify Suspicious Open Networks

nmcli dev wifi list | grep "Open"

• Lists all open networks that might be rogue APs or honeypots.

📌 Monitor Real-Time Network Activity

nmcli monitor

• Continuously monitors network changes, useful for detecting anomalies or unauthorized access.

📌 Detect DNS Spoofing Attacks

nmcli dev show | grep "DNS"

• Checks the current DNS server to detect potential DNS hijacking.

📌 Clone Another Device’s MAC Address

nmcli connection modify "WiFi-SSID" 802-11-wireless.cloned-mac-address <MAC-ADDRESS>

• Spoofs another device’s MAC address to gain access to networks with MAC-based filtering.

📌 Block an Unwanted Wi-Fi Network

nmcli connection modify "UnwantedSSID" connection.autoconnect no
nmcli connection delete "UnwantedSSID"

• Ensures that a specific Wi-Fi network is not automatically connected to.

📌 Check for Rogue Access Points Nearby

nmcli dev wifi list | grep -i "free" | grep -i "wifi"

• Identifies public networks that might be set up to capture credentials.

📌 Fake a Network Disconnection

nmcli networking off && sleep 5 && nmcli networking on

• Simulates a temporary disconnection, which can be useful for testing failover mechanisms.

📌 Identify Nearby Wi-Fi Clients

nmcli dev wifi list | awk '{print $2, $3, $NF}'

• Extracts useful information about detected Wi-Fi clients and their signal strength.

📌 Setup a Man-in-the-Middle (MITM) Attack Environment

nmcli dev wifi hotspot ifname wlan0 ssid EvilAP password "malicious123"

• Creates a fake access point to capture credentials (use only for ethical hacking and authorized testing).

📌 Change Network Adapter Mode to Monitor Mode

nmcli device set wlan0 managed no

• Switches the wireless interface to monitor mode for packet sniffing (requires airmon-ng).

📌 Capture Network Packets for Analysis

nmcli dev wifi rescan && tcpdump -i wlan0

• Starts capturing network packets for further forensic investigation.

📌 Detect ARP Spoofing on the Network

arp -a | grep -i "duplicate"

• Identifies duplicate ARP entries that could indicate a spoofing attack.

📌 Scan for Wi-Fi Networks Without Connecting

nmcli dev wifi list --rescan yes

• Continuously scans for Wi-Fi networks without connecting.

📌 Discover Hidden SSIDs

nmcli dev wifi list | grep "--"

• Lists networks that do not broadcast their SSID.

📌 Connect to a Hidden SSID

nmcli connection add type wifi con-name HiddenSSID ifname wlan0 ssid "HiddenSSID"
nmcli connection modify HiddenSSID wifi-hidden yes
nmcli connection up HiddenSSID

📌 Spoof MAC Address for Anonymity

nmcli connection modify "WiFi-SSID" 802-11-wireless.cloned-mac-address random

• Generates a random MAC address before connecting.

📌 Deauthenticate a Device from a Network (Requires Additional Tools)

nmcli dev disconnect wlan0

• Disconnects your device from a network.

For attacking other devices, use tools like aireplay-ng with caution and ethical consideration.

📌 Force a New IP Address from DHCP

nmcli device disconnect eth0 && nmcli device connect eth0

• Forces DHCP to issue a new IP address.

📌 Monitor Network Traffic in Real-Time

watch -n 2 nmcli device status

• Keeps track of network device status changes.

📌 Set Up a Rogue Wi-Fi Hotspot

nmcli device wifi hotspot ifname wlan0 ssid FakeAP password "maliciouspass"

• Creates a fake Wi-Fi access point (for ethical security testing only!).

📌 Detect Man-in-the-Middle (MITM) Attacks

nmcli -f ACTIVE,SSID,BSSID dev wifi

• Checks if the BSSID changes frequently, indicating a possible MITM attack.

5. Practical Use Cases

• Automating network configuration with scripts.
• Connecting to Wi-Fi without a GUI.
• Troubleshooting network issues.
• Setting up a static IP address.
• Enabling/disabling interfaces (useful for remote servers).
• Creating a Wi-Fi hotspot for internet sharing.
• Sorting and finding the best available Wi-Fi.
• Enhancing privacy with a randomized MAC address.
• Monitoring network connectivity in real time.
• Configuring a metered connection for data savings.
• Checking internet connectivity status.
• Setting custom DNS without modifying the IP.
• Debugging network issues with detailed logs.
• Conducting ethical hacking tests like scanning networks, detecting MITM attacks, and analyzing network behavior.

By mastering nmcli, you can efficiently manage networking on Linux systems, making it a vital tool for administrators, penetration testers, and power users alike. 🚀

By thowfick official