Linux Network
Diagnostics & NAT
Basic Linux network interface, listening port and local tunnel diagnostics. Learn how to inspect routes, scan localhost, monitor sockets with modern tools, and set up simple NAT redirects.
Interfaces & Routing
To identify network interfaces and assigned IP addresses on Linux, use:
A cleaner and more readable version is:
To show only one specific interface, for example eth0:
To check the default route and see which interface is used for outgoing traffic:
You can also ask the system which interface would be used to reach a specific IP address:
Checking open ports on localhost
A simple way to check open TCP ports on the local machine is:
For a more direct IPv4 localhost scan:
For service and version detection:
For a full TCP port scan on localhost:
Modern replacement for netstat & lsof
Modern replacement for netstat
The older command:
still works on systems where the net-tools package is installed, but on modern Linux systems the recommended replacement is ss.
Show listening TCP ports with PID and program name:
Show listening TCP and UDP ports with PID and program name:
Show all established TCP connections with PID and program name:
Show all listening sockets:
Show which process is using a specific port, for example port 8080:
Alternative using lsof
Another useful tool is lsof.
Show all listening TCP ports:
Show which process is listening on port 8080:
Show all network connections owned by a specific process PID:
Checking localhost tunnels
Localhost tunnels are commonly created by SSH, VPN tools, development proxies or container systems. A typical SSH local tunnel can look like this:
This means that local port 127.0.0.1:8080 forwards traffic through SSH to remote.example.com:80.
To check whether the local tunnel port is listening:
To inspect the SSH process that owns the tunnel:
To view the full command line of the process:
To see active SSH TCP connections:
Simple local NAT / redirect examples with iptables
Local Redirect (OUTPUT)
Example: redirect local TCP traffic originally going to 123.45.67.89:443 to a local service on 127.0.0.1:8443:
For redirecting traffic to the local machine itself, REDIRECT is often cleaner:
Explanation:
-A OUTPUT apply to locally generated outgoing packets
-p tcp match TCP traffic
-d 123.45.67.89 match destination IP address
–dport 443 match destination port 443
-j DNAT change destination address
–to-destination new destination IP address and optional port
-j REDIRECT redirect traffic to the local machine
–to-ports 8443 new local destination port
Do not use a wide rule such as -p all unless you really know what you are doing. For port forwarding and local service redirection, it is safer to specify the protocol and destination port.
DNAT for incoming traffic
For incoming traffic from another machine, use the PREROUTING chain instead of OUTPUT.
Example: forward incoming TCP port 443 from a public interface to an internal server:
For router-style forwarding, you usually also need IP forwarding enabled:
And you may need a matching FORWARD firewall rule and possibly MASQUERADE/SNAT depending on your network topology.
Modern nftables alternatives
Many modern Linux distributions use nftables or an iptables-nft backend. For new firewall configurations, nftables is often the preferred native solution.
Example: create a NAT table:
Create an output NAT chain:
Redirect local outgoing TCP traffic for 123.45.67.89:443 to local port 8443:
Create a prerouting NAT chain for incoming traffic:
Forward incoming TCP port 443 to an internal server:
Quick summary
- Use ip to identify network interfaces and routes.
- Use nmap to scan open ports.
- Use ss or lsof to find the PID and program using a port.
- Use iptables for legacy NAT rules.
- Use nftables for modern native Linux firewall and NAT configuration.