ALLPCB
This article summarizes Linux networking tools commonly used in practice. These tools are powerful; typical usage only scratches the surface for utilities such as lsof, ip, tcpdump, and iptables.
This is not an in-depth guide to every advanced feature. Each command could warrant its own article. The goal here is to provide a brief introduction with a few simple examples, so you can remember these tools and use man pages to explore solutions when issues arise.
1. ping
Use ping to check network connectivity and latency, and sometimes for basic DNS resolution (to view a domain's IP):
ping example.com
By default ping continues until manually stopped. Use -c to specify the number of packets, -W to set the maximum wait time, and -I to specify the interface when multiple NICs exist.
Tip: Pressing Ctrl+| during a ping prints a summary with counts of sent and received packets and packet loss.
Other options include -b to send broadcast packets. Note: ping uses IPv4; use ping6 for IPv6.
2. netstat
netstat shows current network connections. A common use is to list which local ports are open and which processes are listening:
netstat -lnpt
netstat can display all network connections, including UNIX sockets. It can also show the local routing table:
netstat - nr
3. lsof
lsof lists open files. Since Linux treats many resources as files, lsof can inspect sockets and pipes as well. The -i option filters network-related entries; its format is [46][protocol][@hostname|host][service|port]. For example, to check which process is using port 22:
lsof -i :22
4. iftop
iftop displays bandwidth usage per host on an interface, similar in concept to top or iotop but for network traffic:
iftop
5. tcpdump
tcpdump is a command-line packet capture tool. Despite its name, it captures all protocols, not just TCP. It can perform many of the same functions as Wireshark with greater flexibility. For example, to capture packets to host 192.168.73.128 on port 22.
6. telnet
telnet is a client for the TELNET protocol, but it is also commonly used to probe whether a TCP port is open. For example, to check if local port 22 is reachable.
7. ifconfig
ifconfig is a familiar network interface configuration tool. It is often used to view interface details (IP address, packets transmitted/received, packet errors) and to configure interfaces (enable/disable, change MTU, modify IP address). To view an interface's IP address, use ifconfig with the interface name.
8. whois
whois queries the domain registration directory to retrieve information about a domain's registrant, registration email, registrar, and related records.
9. route
route displays and modifies the IP routing table.
10. ip
The ip command is very powerful and can replace ifconfig, netstat, route, and arp for many tasks. For example, to view the IP address of interface ens33.
11. brctl
brctl manages Linux bridges. It can view bridges, create bridges, and add interfaces to a bridge. To list existing bridges, use brctl show.
12. traceroute
traceroute traces the route packets take to a network host and reports each hop along the path. It is useful for diagnosing network faults and identifying where latency or packet loss occurs.
13. mtr
mtr combines the functionality of ping and traceroute into a single, continuously updated diagnostic tool.
14. ss
ss is another utility to inspect sockets and displays active socket information.
15. axel
axel is a multi-connection download accelerator. By opening multiple connections, it can significantly increase download speed and supports resuming by default.
Summary: Common Linux networking tools include network configuration: ifconfig, ip; routing: route, netstat, ip; port inspection: netstat, lsof, ss, nc, telnet; download tools: curl, wget, axel; firewall: iptables, ipset; traffic monitoring: iftop, nethogs; connectivity and latency: ping, traceroute, mtr, tracepath; DNS and domain utilities: nslookup, dig, whois; web servers: python (simple HTTP server), nginx; packet capture: tcpdump; bridging: ip, brctl, ifconfig, ovs.
