Linux Network Toolkit - Command Reference

State & Configuration

Questions: What's my network config? What interfaces do I have? What's my default gateway?

ip addr (ip a)

❓ What IP addresses are configured on my interfaces?

# Show all interfaces with IPs
ip a

# Show specific interface
ip addr show eth0

# Show only IPv4
ip -4 a

# Show only IPv6
ip -6 a

What success looks like:

2: eth0: 
    link/ether 00:0c:29:xx:xx:xx
    inet 192.168.1.100/24 brd 192.168.1.255 scope global eth0
    inet6 fe80::20c:29ff:fexx:xxxx/64 scope link

UP: Interface is enabled
inet: IPv4 address is assigned
/24: Subnet mask (255.255.255.0)

What failure looks like:

DOWN: Interface disabled - ip link set eth0 up
NO-CARRIER: Cable unplugged or no link
No inet: No IP assigned - check DHCP or set static

What to do next:

If no IP: Check DHCP logs or manually configure
If DOWN: sudo ip link set eth0 up
Check routes next: ip route

ip route (ip r)

❓ How does my system route traffic? What's my default gateway?

# Show routing table
ip r

# Show routes for specific destination
ip route get 8.8.8.8

# Add route (requires sudo)
sudo ip route add 10.0.0.0/24 via 192.168.1.1

# Delete route
sudo ip route del 10.0.0.0/24

What success looks like:

default via 192.168.1.1 dev eth0 proto dhcp metric 100
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100

default via X.X.X.X: Default gateway (where non-local traffic goes)
proto dhcp: Route learned from DHCP
proto kernel: Automatically added when IP configured

What failure looks like:

No default route: Can't reach internet
Wrong gateway: Traffic goes to wrong router

What to do next:

Test gateway: ping [gateway-ip]
Check specific route decision: ip route get 8.8.8.8
If no default route: Check DHCP or add manually

ip neigh (ARP cache)

❓ What MAC addresses has my system learned?

# Show neighbor cache (ARP table)
ip neigh

# Flush all entries
sudo ip neigh flush all

# Delete specific entry
sudo ip neigh del 192.168.1.1 dev eth0

What success looks like:

192.168.1.1 dev eth0 lladdr aa:bb:cc:dd:ee:ff REACHABLE
192.168.1.50 dev eth0 lladdr 11:22:33:44:55:66 STALE

REACHABLE: Entry is valid and recently confirmed
STALE: Entry exists but hasn't been confirmed recently
DELAY/PROBE: System is verifying the entry

What to do next:

If no entry for gateway: ARP resolution may be failing
If FAILED state: Layer 2 connectivity issue
Test: ping [ip] should populate cache

Path & Connectivity Testing

Questions: Can I reach this host? Where is the packet being dropped? What's the latency?

ping

❓ Is the host reachable? What's the round-trip time?

# Basic ping (Ctrl+C to stop)
ping 8.8.8.8

# Limit to 5 packets
ping -c 5 google.com

# Test MTU (1472 + 28 = 1500 MTU)
ping -s 1472 google.com

# Don't fragment (test path MTU)
ping -M do -s 1472 google.com

# Flood ping (requires sudo, test capacity)
sudo ping -f 8.8.8.8

What success looks like:

64 bytes from 8.8.8.8: icmp_seq=1 ttl=56 time=12.3 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=56 time=11.9 ms
---
5 packets transmitted, 5 received, 0% packet loss
rtt min/avg/max/mdev = 11.8/12.1/12.5/0.3 ms

0% packet loss: Perfect connectivity
Low, consistent RTT: Good network quality
TTL: Decrements at each hop (tracks distance)

What failure looks like:

100% packet loss: No connectivity - check routes, firewall
Destination Host Unreachable: No route to host
High RTT (>100ms): Network congestion or distant host
Variable RTT: Network instability
Packet loss >1%: Quality issue - investigate path

What to do next:

If timeout: Try gateway: ping [gateway-ip]
If gateway works but internet doesn't: DNS or routing issue
For packet loss: Use mtr to locate where
Remember: Some hosts block ICMP (ping works ≠ only test)

traceroute

❓ What path do packets take? Where is the delay?

# Basic traceroute (UDP by default)
traceroute google.com

# Use ICMP (more likely to pass firewalls)
traceroute -I google.com

# Use TCP to specific port
sudo traceroute -T -p 443 google.com

# Set max hops
traceroute -m 20 google.com

What success looks like:

 1  router.local (192.168.1.1)  1.234 ms  1.123 ms  1.056 ms
 2  10.0.0.1 (10.0.0.1)  5.678 ms  5.543 ms  5.432 ms
 3  172.16.1.1 (172.16.1.1)  12.345 ms  12.234 ms  12.156 ms
...
10  google.com (142.250.185.46)  15.234 ms  15.123 ms  15.098 ms

What failure looks like:

* * *: Router not responding (may be configured to not respond, not always a problem)
High latency jump: Bottleneck at that hop
Never reaches destination: Routing black hole or firewall

What to do next:

Use mtr for continuous monitoring
If * * * at end: Destination may block traceroute
Compare multiple traceroutes over time

mtr (My Traceroute)

❓ Where is packet loss occurring? What's the hop-by-hop latency?

# Interactive mode (best for real-time)
mtr google.com

# Report mode (run 100 cycles, then exit)
mtr -r -c 100 google.com

# Wide report (no hostname truncation)
mtr -rw google.com

# Use TCP instead of ICMP
mtr -T -P 443 google.com

What success looks like:

HOST: localhost          Loss%   Snt   Last   Avg  Best  Wrst StDev
  1.|-- router.local       0.0%   100    1.2   1.3   1.0   2.1   0.2
  2.|-- 10.0.0.1           0.0%   100    5.6   5.8   5.2   8.3   0.5
  3.|-- 172.16.1.1         0.0%   100   12.3  12.5  11.9  15.2   0.6
...
 10.|-- google.com         0.0%   100   15.2  15.4  14.8  17.3   0.4

0% Loss: No packet loss at any hop
Low StDev: Stable latency
Gradual latency increase: Normal (each hop adds time)

What failure looks like:

Loss at specific hop only: May be ICMP rate limiting, not real loss
Loss at hop + all subsequent hops: Real issue at that hop
High StDev: Unstable/congested link

What to do next:

Run for 5-10 minutes to see patterns
Loss only at one hop but not after = ICMP deprioritization
If consistent loss: Contact network owner of that hop

Name Resolution

Questions: Can I resolve this domain? Which DNS server am I using? Is DNS working?

dig

❓ What's the IP for this domain? Is DNS working?

# Basic lookup
dig google.com

# Trace full resolution path
dig +trace google.com

# Query specific record type
dig google.com MX    # Mail servers
dig google.com NS    # Nameservers
dig google.com AAAA  # IPv6

# Reverse lookup
dig -x 8.8.8.8

# Query specific DNS server
dig @8.8.8.8 google.com

# Short output (just the answer)
dig +short google.com

What success looks like:

;; QUESTION SECTION:
;google.com.            IN  A

;; ANSWER SECTION:
google.com.     300 IN  A   142.250.185.46

;; Query time: 23 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)

ANSWER SECTION: Contains the IP address
300: TTL in seconds (cache lifetime)
Query time: DNS response time

What failure looks like:

SERVFAIL: DNS server couldn't resolve
NXDOMAIN: Domain doesn't exist
No response / timeout: Can't reach DNS server
connection timed out: Firewall blocking port 53

What to do next:

If timeout: Check DNS server IP in /etc/resolv.conf
Try different server: dig @8.8.8.8 google.com
Compare results from different DNS servers
For delegation issues: Use dig +trace

getent hosts

❓ How does the OS resolve this hostname? (includes /etc/hosts)

# Resolve hostname using system resolver
getent hosts google.com

# Check specific host
getent hosts localhost

# Get all hosts
getent hosts

Why use this over dig:

Follows /etc/nsswitch.conf order
Checks /etc/hosts before DNS
Reflects what applications actually use
dig queries DNS directly, bypassing NSS

What to do next:

Check /etc/hosts for overrides: cat /etc/hosts
Check resolver order: cat /etc/nsswitch.conf | grep hosts
Check DNS config: cat /etc/resolv.conf

TCP & Sockets

Questions: What's listening? Can I connect? What's the connection state?

ss (Socket Statistics)

❓ What ports are listening? What connections exist?

# Show all TCP connections
ss -tan

# Show listening TCP ports with process info
sudo ss -tlnp

# Show established connections only
ss -tan state established

# Show connections to specific port
ss -tan '( dport = :443 or sport = :443 )'

# Show TCP info (cwnd, RTT, retransmissions)
ss -ti

# Show connection to specific host
ss -tan dst 8.8.8.8

# Memory usage per socket
ss -tm

What success looks like:

State    Recv-Q Send-Q Local Address:Port  Peer Address:Port
LISTEN   0      128    0.0.0.0:22           0.0.0.0:*      users:(("sshd",pid=1234))
ESTAB    0      0      192.168.1.100:54321  8.8.8.8:443

LISTEN: Service waiting for connections
ESTAB: Active connection
Recv-Q/Send-Q = 0: No data buffered

What failure looks like:

No LISTEN on expected port: Service not running
High Recv-Q: Application not reading fast enough
High Send-Q: Network congestion or slow receiver
Many TIME-WAIT: High connection turnover

What to do next:

If not listening: Start service or check config
For TCP details: ss -ti shows retransmissions, cwnd
Count connections: ss -tan | wc -l

nc (netcat)

❓ Can I establish a TCP connection to this port?

# Test TCP connection
nc -vz google.com 443

# Test multiple ports
nc -vz google.com 80 443 22

# Connect and send data
echo "GET / HTTP/1.1\r\nHost: example.com\r\n\r\n" | nc example.com 80

# Listen on port (simple server)
nc -l 8080

# Port scan range
nc -vz -w 2 192.168.1.1 20-25

What success looks like:

Connection to google.com 443 port [tcp/https] succeeded!

TCP handshake completed successfully.

What failure looks like:

Connection refused: Port closed (RST received)
Connection timed out: Filtered/firewall or host down
No route to host: Network unreachable

What to do next:

If refused: Check if service is running and listening
If timeout: Check firewall rules, routing
Use tcpdump to see if packets are sent/received

curl

❓ Can I make an HTTP/HTTPS request? What's the timing?

# Verbose HTTPS request
curl -v https://google.com

# Headers only
curl -I https://google.com

# Show timing breakdown
curl -w "@curl-format.txt" -o /dev/null -s https://google.com

# Create curl-format.txt:
cat > curl-format.txt << 'EOF'
    time_namelookup:  %{time_namelookup}s
       time_connect:  %{time_connect}s
    time_appconnect:  %{time_appconnect}s
   time_pretransfer:  %{time_pretransfer}s
      time_redirect:  %{time_redirect}s
 time_starttransfer:  %{time_starttransfer}s
                    ----------
         time_total:  %{time_total}s
EOF

# Follow redirects
curl -L https://google.com

# Specify IP (bypass DNS)
curl --resolve google.com:443:142.250.185.46 https://google.com

What success looks like:

* Connected to google.com (142.250.185.46) port 443
* SSL connection using TLS1.3 / ECDHE-ECDSA-AES128-GCM-SHA256
< HTTP/2 200
< content-type: text/html

What to do next:

Compare different URLs/IPs to isolate issue
Check if HTTP works but HTTPS doesn't (TLS issue)
Use timing info to identify slow components

Counters & Statistics

Questions: Are packets being dropped? Are there errors? What's the traffic volume?

ip -s link

❓ Are there interface errors or drops?

# Show interface statistics
ip -s link

# Show specific interface
ip -s link show eth0

# More detailed stats
ip -s -s link show eth0

What success looks like:

2: eth0: 
    RX: bytes  packets  errors  dropped overrun mcast
    1234567    10000    0       0       0       100
    TX: bytes  packets  errors  dropped carrier collsns
    7654321    8000     0       0       0       0

errors = 0: No physical layer issues
dropped = 0: No buffer overflows
collsns = 0: No duplex mismatch

What failure looks like:

RX errors: Bad cable, NIC issue, or duplex mismatch
RX dropped: Receive buffer full (CPU overload)
TX errors: Transmission problems
Collisions: Duplex mismatch (half vs full)

What to do next:

Check duplex settings: ethtool eth0
If errors increasing: Replace cable or check NIC
If drops: Check for CPU/memory pressure

netstat -s / ss -s

❓ How many retransmissions? Connection failures?

# Show all protocol statistics
netstat -s

# Show TCP statistics only
netstat -st

# ss summary
ss -s

# Watch retransmissions
watch -n 1 "netstat -s | grep -i retrans"

Key metrics to watch:

segments retransmitted: Should be <1% of total
connection resets: Applications or firewalls closing
failed connection attempts: Unreachable hosts
passive connection openings: Incoming connections
active connection openings: Outgoing connections

What to do next:

High retransmissions: Check packet loss with mtr
Many resets: Application or firewall issue
Failed connections: Unreachable servers or firewall

Packet Capture & Analysis

Questions: What's actually on the wire? Is the SYN being sent? Why is the handshake failing?

tcpdump

❓ What packets are actually being sent/received?

# Capture on all interfaces
sudo tcpdump -i any

# Capture specific host
sudo tcpdump host google.com

# Capture specific port
sudo tcpdump port 443

# Capture TCP to specific host and port
sudo tcpdump 'tcp and host google.com and port 443'

# Save to file for Wireshark
sudo tcpdump -i any -w capture.pcap

# Read from file
tcpdump -r capture.pcap

# Show packet contents
sudo tcpdump -X

# Show only SYN packets
sudo tcpdump 'tcp[tcpflags] & tcp-syn != 0'

# Don't resolve names (faster)
sudo tcpdump -nn

# Limit packet count
sudo tcpdump -c 100

What to look for:

SYN → SYN-ACK → ACK: Successful handshake
SYN → RST: Port closed
SYN → (nothing): Filtered or unreachable
[Retransmission]: Packet loss
[Dup ACK]: Out-of-order or loss

What to do next:

Open .pcap files in Wireshark for detailed analysis
Filter by TCP flags to see handshakes
Look for gaps in sequence numbers (loss)
Check timing between packets