nmcli
network settings that persistnmcli is the command-line face of NetworkManager, which manages networking on most desktops and many servers. Unlike ip, what it configures is saved and applied again at boot — a static address, a DNS server, a Wi-Fi password.
ip changes the network until reboot; nmcli changes it for good.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
The device, its type, whether it is connected, and which saved profile it is using.
eth0 is the hardware. "Wired connection 1" is a profile — a set of saved settings applied to it.
--ask prompts for the password instead of taking it on the command line, where it would be saved in your history.
A profile has been saved. The machine will rejoin this network by itself next time.
Switches
A switch changes how the command behaves. These are the ones used day to day; man nmcli lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-t- Terse: colon-separated output for scripts.
-f FIELDS- Show only these fields.
-p- Pretty: add headers and alignment.
--ask- Prompt for missing values such as a password.
-s- Show secrets, such as saved Wi-Fi passwords. Needs root.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
nmcli connection showLists the saved connection profiles.
nmcli con mod "Wired connection 1" ipv4.addresses 192.168.1.50/24 ipv4.gateway 192.168.1.1 ipv4.method manualSets a static address on a profile.
nmcli con up "Wired connection 1"Applies a profile after changing it.
nmtuiA menu-driven version of the same tool.
In cybersecurity
Saved connections store their passwords on disk.
Profiles live in /etc/NetworkManager/system-connections, readable only by root, with the passphrase in plain text. A root compromise reveals every network the machine has joined.
A laptop will connect to any network with a remembered name. Remove profiles for open and public networks so an impostor access point cannot claim it.
A wrong address or gateway cuts your own connection, and it stays wrong after a reboot. Have console access before changing a remote machine’s network.