Linux Network Commands Every Admin Should Know

Whether you’re troubleshooting a connectivity issue or auditing a server, knowing the right network commands saves hours of guesswork. This guide covers the essential Linux networking tools every administrator should have at their fingertips.

Inspecting Interfaces and IP Addresses

The modern way to view network interfaces is the ip command from the iproute2 suite. It has replaced the older ifconfig on most distributions.

Read also: Carry 1100 Operating Systems on a Single USB Drive

• ip a (or ip addr) — list all interfaces with their IPv4 and IPv6 addresses.
• ip -br a — a brief, column-formatted summary that’s easy to scan.
• ip link set eth0 up — bring an interface up; use down to disable it.
• ip r (or ip route) — show the kernel routing table and your default gateway.

If you still rely on ifconfig, install the net-tools package, but learning ip is the better long-term investment.

Testing Connectivity and DNS

When something can’t reach the network, work outward from the host. Start with the loopback, then the gateway, then an external host.

• ping -c 4 8.8.8.8 — send four ICMP packets to test raw reachability without DNS.
• ping -c 4 google.com — if the IP works but the name fails, you have a DNS problem.
• traceroute google.com — map every hop between you and a destination to locate where packets stop.
• dig google.com or host google.com — query DNS records directly. Add +short to dig for a clean answer.
• nslookup google.com — a classic, portable DNS lookup tool.

Sockets, Ports, and Connections

To see what’s listening and what’s connected, ss is the fast, modern replacement for netstat.

• ss -tulpn — show all tCP and uDP listening sockets with the owning process and numeric ports.
• ss -tan state established — list every established TCP connection.
• netstat -tulpn — the equivalent if ss isn’t available.

To check whether a specific remote port is open, nc -zv example.com 443 attempts a connection and reports success or failure. For HTTP debugging, curl -I https://example.com fetches just the response headers.

Downloading, Capturing, and Diagnosing

A few more tools round out a complete toolkit:

1. curl and wget — transfer files and test endpoints from the command line.
2. tcpdump -i eth0 port 80 — capture live packets on an interface for deep inspection.
3. nmap -sV 192.168.1.1 — scan a host for open ports and service versions (only on systems you’re authorized to test).
4. mtr google.com — combines ping and traceroute into a continuously updating report, ideal for spotting intermittent loss.

Finally, ethtool eth0 reveals link speed and duplex settings, which is invaluable when a connection is up but mysteriously slow.

Frequently Asked Questions

What replaced ifconfig and netstat in modern Linux?

The ip command (from iproute2) replaces ifconfig and route, while ss replaces netstat. They are faster, show more detail, and are installed by default on current distributions.

How do I find which process is using a port?

Run ss -tulpn as root and look at the Process column, or use sudo lsof -i :8080 to see exactly which program owns port 8080.

Why does ping to an IP work but ping to a hostname fails?

That almost always indicates a DNS resolution problem. Check /etc/resolv.conf for valid nameservers and confirm with dig that lookups succeed.

Do these commands need root privileges?

Viewing information with ip a or ss works as a normal user, but changing interfaces, capturing packets with tcpdump, or running nmap scans typically requires sudo.