Linux Network Commands

The modern Linux networking command set - ip, ss, ethtool, tcpdump, nft - with the exact invocations worth memorising.

Reference Protocol Reference Runs in your browser

Result

Commands shown

36 of 36

Commands

Command	Area	What it does
ip addr show	Addressing	List interfaces and addresses. Replaces ifconfig.
ip -br -c addr	Addressing	Brief coloured summary - the fastest overview.
ip addr add 10.0.0.5/24 dev eth0	Addressing	Add an address (not persistent).
ip link set eth0 up	Interfaces	Bring an interface up.
ip link set eth0 mtu 9000	Interfaces	Change MTU.
ip -s link show eth0	Interfaces	Interface counters including errors and drops.
ip route	Routing	Show the main routing table.
ip route get 8.8.8.8	Routing	Show which route and source address a destination would use.
ip route add 10.1.0.0/16 via 10.0.0.1	Routing	Add a static route.
ip rule show	Routing	Policy routing rules - check when routing looks impossible.
ip neigh	L2	ARP and NDP neighbour table.
bridge fdb show	L2	Bridge forwarding database (MAC table).
ss -tulpn	Sockets	Listening TCP/UDP sockets with process names. Replaces netstat.
ss -tan state established	Sockets	Established TCP connections.
ss -ti	Sockets	Per-socket TCP internals: cwnd, rtt, retransmits.
ethtool eth0	Physical	Link speed, duplex and autonegotiation state.
ethtool -S eth0	Physical	Driver-level statistics including drops and errors.
ethtool -m eth0	Physical	SFP diagnostics - optical transmit and receive power.
tcpdump -ni eth0 host 10.0.0.5 and port 443	Capture	Filtered capture, numeric output.
tcpdump -ni any -w /tmp/cap.pcap -s0	Capture	Full-size capture to a file for Wireshark.
tcpdump -nei eth0 vlan	Capture	Show VLAN tags and MAC addresses.
mtr -rwbzc 100 8.8.8.8	Path	Combined ping and traceroute report with loss per hop.
ping -M do -s 1472 8.8.8.8	Path	Path MTU test with do-not-fragment set.
dig +short A example.com	DNS	Just the answer.
dig @1.1.1.1 example.com MX +noall +answer	DNS	Query a specific resolver.
dig +trace example.com	DNS	Follow delegation from the root - finds broken delegations.
curl -svo /dev/null https://example.com	HTTP	Headers, TLS handshake and timing without the body.
curl -w "@-" -o /dev/null -s https://example.com	HTTP	Custom timing breakdown with a format string.
nc -zv host 443	Testing	TCP port reachability test.
nmap -Pn -p 1-1024 host	Testing	Port scan - only against systems you are authorised to test.
nft list ruleset	Firewall	Show the full nftables ruleset.
iptables -L -n -v --line-numbers	Firewall	Legacy iptables with counters.
conntrack -L	Firewall	Connection tracking table - check for exhaustion.
sysctl net.ipv4.ip_forward	Kernel	Check whether forwarding is enabled.
sysctl -a \| grep rmem	Kernel	Socket buffer tuning for high-BDP paths.
nstat -az \| grep -i retrans	Kernel	TCP retransmission counters.

A four-command triage sequence

# Where did that packet go?
ip route get 8.8.8.8

# Is the interface actually healthy?
ip -s link show eth0 && ethtool -S eth0 | grep -i -E "err|drop|discard"

# What is listening, and as which process?
ss -tulpn

# Is TCP retransmitting?
nstat -az | grep -i retrans

net-tools is retired

ifconfig, route, netstat and arp come from net-tools and are unmaintained - they hide policy routing, multiple addresses per interface and modern socket state. Every modern distribution ships iproute2 instead.

About Linux Network Commands

The iproute2 suite replaced the ifconfig-era tools two decades ago, but muscle memory is stubborn. This is the modern equivalent set, with the specific invocations that answer real questions rather than the ones that just print everything.

Reading a capture filter correctly

tcpdump filters run in the kernel and are cheap; post-filtering in Wireshark on a full capture is not. Learn four primitives and most needs are covered: host, net, port and proto, combined with and, or and not. Two traps: -n stops tcpdump generating DNS lookups that pollute your own capture, and a filter such as tcp port 443 does not match a fragmented continuation packet because only the first fragment carries the TCP header.

The one command worth memorising

ip route get <destination> answers, in one line, which route will be used, which interface it leaves by and which source address it will carry. It accounts for policy routing rules that a plain route table dump hides entirely, and it settles most "why is traffic going that way" arguments immediately.

Common use cases

Triaging a Linux host that cannot reach a destination.
Reading optical levels from an SFP without leaving the host.
Capturing filtered traffic for analysis without collecting gigabytes.

Edge cases and gotchas

ip addr and ip route changes are not persistent - write them into the distribution's network configuration.
tcpdump defaults to a truncated snaplen on some older versions; use -s0 when capturing for later analysis.

Frequently asked questions

Why does ip route get differ from what ip route shows?

Because policy routing is consulted first. Rules in ip rule show can direct a lookup to another table entirely, so the main table you were reading was never used for that destination.

What replaced netstat?

ss, which reads socket state directly from the kernel via netlink and is far faster on busy hosts. ss -tulpn is the direct equivalent of netstat -tulpn.