Linux Network
Commands & Tools
This is a practical overview of useful Linux networking commands and tools. Some older tools are still available, but modern Linux systems usually prefer commands from iproute2, nftables, NetworkManager and newer wireless utilities.
1. Interfaces & 2. Sockets
1. Basic network interface information
Show IP addresses and interfaces:
Short readable output:
Show link state and MAC addresses:
Show interface statistics:
Show the default route:
Check which interface would be used to reach a destination:
Legacy equivalents:
route
arp
Modern replacements:
route -> ip route
arp -> ip neigh
netstat -> ss
2. Socket and listening port diagnostics
Show listening TCP ports with PID and program name:
Show listening TCP and UDP ports:
Show established TCP connections:
Show all sockets:
Find which process is listening on port 8080:
Alternative using lsof:
Show which process owns a specific port:
3. DNS & 4. Connectivity Testing
3. DNS tools
Query DNS records with dig:
Query a specific DNS record type:
dig example.com AAAA
dig example.com MX
dig example.com TXT
Query a specific DNS server:
Reverse DNS lookup:
Simple DNS lookup:
Interactive or simple DNS query:
Whois lookup:
4. Connectivity and route testing
Basic ICMP test:
IPv4-only ping:
IPv6-only ping:
Trace route path:
Trace path without requiring raw socket privileges on many systems:
Combined ping and traceroute diagnostic:
Generate a report with mtr:
5. Port Scanning & 6. Bandwidth Testing
5. Port scanning and service discovery
Scan common ports on a host:
Scan a specific IP:
Detect service versions:
Scan all TCP ports:
Scan selected ports:
Important: scan only your own systems or systems where you have permission.
6. Bandwidth and speed testing
Measure bandwidth between two machines with iperf3.
On the server side:
On the client side:
Reverse direction test:
UDP test:
Internet speed test:
Some distributions provide speedtest-cli, but the official Ookla tool is often named speedtest.
7. Live Monitoring & 8. Packet Capture
7. Live bandwidth monitoring
Show bandwidth usage per interface:
Simple live interface bandwidth:
Per-process network usage:
Show bandwidth usage by connection:
Interface statistics:
Long-term traffic statistics:
Show vnStat summary:
Show traffic for one interface:
8. Packet capture and protocol analysis
Capture packets on an interface:
Capture only traffic on port 443:
Capture traffic to or from a specific host:
Save capture to a file:
Read a capture file:
Wireshark provides a graphical protocol analyzer and can open .pcap files created by tcpdump.
Text-mode Wireshark tool:
9. HTTP Testing & 10. Netcat/Socat
9. HTTP, HTTPS and API testing
Download or test a URL with curl:
Show HTTP response headers:
Follow redirects:
Verbose TLS and HTTP debugging:
Download a file with wget:
Alternative human-friendly HTTP client:
Check a TLS certificate manually:
10. Netcat, Ncat and Socat
Test whether a TCP port is reachable:
Listen on a local TCP port:
Connect to a TCP port:
Ncat is the modern Nmap Project implementation of netcat:
Socat can connect two bidirectional byte streams. Example TCP listener:
Forward local TCP port 9000 to another host:
WebSocket forwarding tool:
11. SSH, 12. DHCP & 13. Wireless Tools
11. SSH and secure remote administration
Connect to a remote server:
Use a custom SSH port:
Copy a file over SSH:
Synchronize files efficiently:
Create a local SSH tunnel:
Create a SOCKS proxy:
12. DHCP and address assignment
Request an IP address with dhclient:
Release DHCP lease:
On systems managed by NetworkManager, use nmcli instead:
nmcli connection show
sudo nmcli connection up CONNECTION_NAME
sudo nmcli connection down CONNECTION_NAME
Text user interface for NetworkManager:
13. Wireless tools
Modern Wi-Fi diagnostics should use iw:
Show link status:
Scan nearby Wi-Fi networks:
Legacy wireless-tools commands:
iwlist
iwspy
iwpriv
These older Wireless Extensions tools are legacy. For modern drivers and current Linux systems, prefer iw, nmcli, nmtui, NetworkManager or iwd.
14. Firewall, 15. Packet Tools, 16. IDS & 17. Routing
14. Firewall, NAT and packet filtering
Modern native Linux firewall tool:
Show nftables ruleset:
Legacy iptables rules:
Show NAT rules:
Many modern distributions use nftables directly or through an iptables-nft compatibility backend.
Simple UFW firewall commands:
sudo ufw allow 22/tcp
sudo ufw enable
firewalld commands:
sudo firewall-cmd –add-service=ssh –permanent
sudo firewall-cmd –reload
15. Advanced packet tools
hping3 can craft and analyze TCP/IP packets. Use only on systems and networks where you have permission.
ngrep applies grep-like filtering to network traffic:
netsniff-ng is a high-performance network toolkit:
tcptrack displays TCP connection information on an interface:
16. Intrusion detection and monitoring
Snort is a network intrusion detection and prevention system.
Suricata is another modern IDS/IPS engine often used for network security monitoring.
SmokePing can monitor network latency over time.
darkstat captures network traffic statistics and provides usage graphs.
arpwatch monitors Ethernet/IP address pair changes and can help detect unexpected ARP activity.
17. Routing daemons
gated is historically known as a gateway routing daemon, but it is not a normal modern choice for new Linux routing setups.
Modern routing suites include:
BIRD
FRR supports common routing protocols such as BGP, OSPF, RIP and IS-IS.
18. Legacy Tools & 19. Practical Command Groups
18. Legacy tools that may still be useful
The net-tools package includes older commands:
hostname
ifconfig
netstat
route
rarp
slattach
mii-tool
iptunnel
ipmaddr
These commands can still be useful on older systems or in old documentation, but for modern Linux administration prefer:
ip route instead of route
ip neigh instead of arp
ss instead of netstat
iw instead of iwconfig / iwlist
nft instead of direct legacy iptables where possible
19. Practical command groups
Quick interface and route check:
ip route
ip route get 8.8.8.8
Quick listening port check:
Quick DNS check:
host example.com
Quick path and latency check:
mtr -rw example.com
Quick service scan:
Quick bandwidth test between two Linux machines:
iperf3 -c SERVER_IP
Quick packet capture:
Quick process-by-port check:
sudo lsof -nP -iTCP:443 -sTCP:LISTEN
20. Tool list by purpose
ip, iproute2, nmcli, nmtui, ethtool
Sockets and processes:
ss, lsof
DNS:
dig, host, nslookup, whois
Connectivity diagnostics:
ping, traceroute, tracepath, mtr
Port scanning:
nmap, ncat
Bandwidth testing:
iperf3, netperf, speedtest
Live traffic monitoring:
bmon, nload, iftop, ifstat, nethogs, vnstat, bwm-ng, slurm
Packet capture and analysis:
tcpdump, tshark, Wireshark, ngrep, netsniff-ng
HTTP and downloads:
curl, wget, httpie
Remote administration and transfer:
ssh, scp, rsync, sftp
Firewall and NAT:
nftables/nft, iptables, ufw, firewalld
Wireless:
iw, nmcli, nmtui, iwd, legacy wireless-tools
IDS and security monitoring:
snort, suricata, arpwatch, smokeping, darkstat
Advanced stream and socket tools:
netcat, ncat, socat, websocat
Routing daemons:
FRRouting/FRR, BIRD