In “Network Information”, LinPEAS lists interfaces, hosts/DNS, neighbours, listening ports and firewall rules. It also probes outbound connectivity by default — contacting external IPs over TCP 80/443, ICMP and DNS — which is important to know for scoped engagements. Listening ports are the offensive gold: they reveal local-only services to pivot into.
Where it appears in the output#
Network checks are in the Network Information section (network_information). Active network recon (host discovery, port scanning) is separate and only runs with -t, -d, -p, -i — those flags change LinPEAS into a network scanner, so use them only when the scope covers it.
The connectivity probes reach 1.1.1.1 and 104.18.74.230 by default. If outbound traffic is out of scope, account for this before running. The documented -n flag does not reliably disable it in the build we reviewed — see is LinPEAS safe?
How to read the network section#
| Item | What it tells you |
|---|---|
| Interfaces & IPs | Which networks the host touches — multi-homed hosts are pivot points |
Listening ports (ss -tulpn) | Services bound to localhost are reachable only from the box — prime lateral targets |
| Established connections | Who the host talks to: databases, internal APIs, other hosts |
| Firewall rules | What filtering exists — and what it forgot |
| DNS / hosts file | Internal hostnames that map the network for you |
| ARP / neighbours | Other live hosts on local segments |
Reproduce the checks manually#
ip a; ip route # interfaces and routes
ss -tulpn 2>/dev/null || netstat -tulpn 2>/dev/null # listening ports
ss -tunp 2>/dev/null | grep ESTAB # active connections
iptables -L -n 2>/dev/null; nft list ruleset 2>/dev/null # firewall
cat /etc/hosts /etc/resolv.conf # namingFrom listening ports to lateral movement (authorised scope)#
A service listening on 127.0.0.1 is invisible from the network but fully reachable from your shell. The authorised workflow is:
- 1
- 2
- 3
- 4
Port forwarding with -F (authorised use)#
LinPEAS can forward a port through the target with -F LOCAL_IP:LOCAL_PORT:REMOTE_IP:REMOTE_PORT, exposing a remote service on your local interface so you can interact with it using your own tooling. Like all pivoting, this is done only where the scope explicitly permits lateral movement.
Reading network-recon flag output#
When you deliberately run the recon flags, the output changes character — it becomes a scanner report. What each flag produces:
| Flags | Output | Scope note |
|---|---|---|
-t | Automatic network scan, results written to files | Broad — only with explicit network scope |
-d 192.168.1.0/24 | Live hosts via fping/ping | Noisy on monitored networks |
-d … -p 22,80,443 | Hosts with those TCP ports open (via nc) | Port sweep — easily detected |
-i 10.0.0.5 -p 80,443 | Port scan of one IP (default: nmap top1000) | Targeted; still active scanning |
-F l:s:r:p | Port forward through the target | Pivoting — strict scope only |
- Recon output goes to files — check the working directory after the run.
- Remember:
-d/-p/-iwithout-trun only the network scan — no privesc checks. - On an engagement, active scanning is usually a separately-approved phase. Passive enumeration (the default section) comes first.
Localhost services worth a second look#
These show up on 127.0.0.1 constantly in LinPEAS reports. Each is a candidate for local-only probing:
| Service | Default localhost port(s) | Why it matters |
|---|---|---|
| MySQL / MariaDB | 3306 | Weak creds or unauthenticated access → data, sometimes RCE |
| PostgreSQL | 5432 | Trust-auth misconfigurations are common |
| Redis | 6379 | No-auth default historically → RCE via module/config write |
| MongoDB | 27017 | Old versions bound without auth |
| Elasticsearch | 9200 | Unauthenticated API → data exposure, script execution (old) |
| Debug/admin panels | various (8000, 8080, 5000) | Exposed dashboards often lack auth locally |
Rule of thumb: if it listens only on localhost, the developer assumed “only I can reach it” — your shell proves that assumption wrong. Probe gently, report, move on.
IPv6: the forgotten listener#
LinPEAS lists IPv6 listeners too — and services bound to :: accept IPv6 connections from anywhere the firewall allows. Audits that only review IPv4 rules miss these. When LinPEAS shows a :::port listener, check the IPv6 firewall (ip6tables -L) with the same scepticism as the IPv4 one.
How to fix network findings (defensive)#
- Bind services to
127.0.0.1only when remote access is not needed — and still authenticate them. - Firewall the host: default-deny inbound, allow only required ports (
iptables/nftables/ufw). - Remove or disable services you do not need — every listener is attack surface.
- Egress-filter as well: unexpected outbound connections are how data leaves.
- Log and alert on new listeners; re-run LinPEAS after changes to verify.
Related: is LinPEAS safe? (outbound behaviour), network recon flags, containers.
Sources & references
- linPEAS README
- PEASS-ng release — reviewed 20260908-dffb9496
- HackTricks: Linux privilege escalation