Hack the Route Start free Open app Reference
93 networking commands
The Linux commands the labs use, in troubleshooting order: syntax, the options worth knowing, real output and how to read it.
Interfaces and addresses
Is my card up, and which address and network does it have?
- ip addr Shows each network card with its addresses and prefix, and adds or removes addresses.
- ipcalc Works out an address's network, broadcast address and mask from its prefix.
- ip link Shows each network card's state, MAC address, MTU and counters, and switches it up or down.
- ethtool Shows and sets a card's physical link (speed, duplex, auto-negotiation) and prints its driver's own counters.
- ip maddr Lists the multicast groups each card has joined, and the group MAC addresses it accepts.
- sysctl Reads and sets kernel settings, such as whether this device forwards packets like a router.
- lldpcli Reads and sets lldpd: the LLDP and CDP neighbours heard on each card, and what this device announces.
- ifup Brings a card up as /etc/network/interfaces describes it, or takes it down again.
- iw Shows and sets a Wi-Fi radio: its mode, channel and link, the networks it can see, and monitor mode.
Neighbours
Who is on my own network, and which MAC address answers for an address?
- ip neigh Shows the neighbour table, the IP-to-MAC answers this device learned with ARP or neighbour discovery.
- arping Asks an address on your own network for its MAC address with ARP, below IP and any firewall.
- bridge Shows a Linux switch's ports, their spanning tree state, and the MAC addresses it has learned behind each.
- ovs-vsctl Configures an Open vSwitch switch: its bridges and ports, the controller it takes orders from, and its fail mode.
- ovs-ofctl Speaks OpenFlow to a switch: lists, adds and removes the flows it forwards by, and shows its ports.
- ovs-appctl Asks a running Open vSwitch for internal state the database does not show — here, its Rapid Spanning Tree view.
- rdisc6 Sends a router solicitation and prints every router advertisement that answers, field by field.
Routes and paths
Where does a packet go next, does it arrive, and where does it stop?
- ip route Shows the routing table, asks which route a destination takes, and adds or removes routes.
- ip rule Shows and changes the policy rules that pick which routing table a packet is looked up in.
- ping Sends ICMP echo requests to an address and times the replies: reachable, how far, how fast, how lossy.
- traceroute Lists every router on the way to an address, one line per hop, by sending probes with growing TTL.
- tracepath Traces the path like traceroute and also finds the largest packet the whole path carries.
- ip -f mpls route The ip MPLS command shows and changes the label table: which label comes in, which goes out, and to which neighbour.
Names
Which address does a name turn into, and who says so?
- dig Asks a DNS server a question and prints the full answer: status, records, who answered and how long it took.
- getent hosts The getent command resolves a name the way programs do, /etc/hosts first; /etc/resolv.conf says where names come from.
- delv Looks a name up and checks its DNSSEC signatures itself, from a trust anchor, instead of trusting a resolver's ad flag.
- dnssec-dsfromkey Computes the DS record, the digest a parent zone publishes, from a zone's key-signing key.
Ports and connections
Is anything listening, and can I talk to it?
- ss Lists sockets: which ports are listening, which connections are open, and TCP's view of each.
- nc Opens a raw TCP or UDP connection, or listens for one: the simplest way to test a port by hand.
- telnet Opens a TCP connection to a port and says plainly whether it worked: the classic port check.
- nmap Scans a device or a network for open ports and live hosts, and tells open, closed and filtered apart.
- smbclient Talks to an SMB/CIFS file server: lists its shares and reads or writes files, like a mounted network drive.
- sipp Places or answers SIP calls to test VoIP: it drives the INVITE/200 OK/ACK/BYE exchange and reports the result.
- curl Sends an HTTP or HTTPS request and prints the answer: the page, the headers, or the whole conversation.
- nghttp An HTTP/2 client that prints every frame it sends and receives.
- openssl s_client Opens a TLS connection by hand and shows the certificate the server presents, and who signed it.
- socat Connects any two data streams, network or local: a flexible nc, and the way to talk to a daemon's control socket.
- conntrack Lists and edits the kernel's table of tracked flows: what a stateful firewall and NAT remember.
On the wire
What is actually sent and received?
- tcpdump Prints the packets passing a network card, filtered by address, port or protocol: the ground truth.
- tshark Reads a capture file and dissects it: filter by protocol field, print chosen fields, follow a stream, export files.
- nping Builds and sends packets or frames by hand, with any source address, and shows what comes back.
Firewall and NAT
Is a rule dropping, refusing or rewriting the traffic?
Speed and link quality
How fast is it, and what makes it slow?
- h2load Sends many HTTP/2 (or HTTP/1.1) requests and reports how they did, header compression included.
- tc Shows and changes the queues on a network card: delay and loss (netem), shaping (tbf, htb with classes), fair queueing (sfq), policing.
- iperf3 Measures how fast data moves between two devices over TCP or UDP, second by second.
- ip tcp_metrics Shows and clears what Linux remembers about each destination from earlier TCP connections.
Services and tunnels
Is the program behind the network doing its job?
- dnssec-signzone Signs a zone file with its keys: an RRSIG for every record set, NSEC records, and the signed zone to serve.
- rndc Controls a running BIND name server: reload a zone, flush its cache, show its status.
- named-checkzone Reads a zone file as BIND would and reports its serial, or the line at fault.
- vtysh The routing daemon's shell (FRR): shows and changes static routes, OSPF and BGP neighbours, databases and learned routes.
- keepalived Runs VRRP on Linux: routers sharing a virtual gateway address, one master holding it at a time.
- wg Shows WireGuard tunnels: each peer, its endpoint, the addresses it may use, and when it last spoke.
- swanctl Controls strongSwan's IPsec daemon: loads connections, lists the IKE and ESP SAs, brings tunnels up and down.
- ip xfrm Shows the kernel's IPsec tables: the policies that pick what goes into a tunnel, and the SAs that encrypt it.
- ip tunnel Makes, shows and changes IP tunnel cards such as GRE: a virtual link that wraps each packet in a new IP header.
- ssh Opens an encrypted shell on another device, directly or through a jump host, and forwards ports through it.
- lftp An FTP client: logs in, lists, downloads and uploads, and with -d shows every command and reply.
- tftp Copies a file to or from a TFTP server: no login, no listing, no encryption.
- scp Copies files to or from another machine over SSH: logged in and encrypted.
- sftp An interactive file session over SSH: ls, get, put, rm, as with FTP but logged in and encrypted.
- udhcpc Asks the network for an address with DHCP and applies what the server offers: address, gateway, DNS.
- udhcpc6 Asks a DHCPv6 server for an address (stateful) or only for settings such as DNS servers (stateless).
- radvd The router advertisement daemon: which prefixes, flags, lifetimes and DNS servers a router advertises.
- dhcrelay Relays DHCP: passes clients' broadcasts on to a DHCP server on another network, as `ip helper-address` does on IOS.
- chronyc Asks the chrony time daemon which clocks it follows, how far off its own clock is, and changes its sources.
- chronyd The chrony time daemon; with -Q it asks a server once, prints how far off the clock is and exits, setting nothing.
- faketime Runs one command as if the clock read another time, without changing any clock.
- busybox ntpd BusyBox's small NTP client and server; with -w it only asks a server and prints the offset, setting nothing.
- ptp4l Runs the Linux PTP (IEEE 1588) daemon on a card: elects a grandmaster and syncs clocks to nanoseconds through a four-timestamp exchange.
- radtest Asks a RADIUS server whether a user name and password are accepted, as a switch or access point would.
- radwho Lists who is logged in right now, by the RADIUS server's accounting records alone.
- hostapd Turns a Wi-Fi radio into an access point: beacons an SSID and runs WPA2-PSK, WPA3-SAE or Enterprise.
- wpa_supplicant The 802.1X client: logs a wired or Wi-Fi card in with EAP; wpa_cli shows and steers its state.
- hostapd_cli Asks hostapd, the 802.1X authenticator on a switch port or access point, about the devices it has logged in.
- ldapsearch Searches an LDAP directory; its siblings bind, change passwords, and add, modify or delete entries.
- kinit Gets a Kerberos ticket-granting ticket with a password; klist shows the cache, kdestroy empties it, kvno fetches a service ticket.
- kadmin Manages a Kerberos realm: its principals and their keys, and writes server keys into keytabs.
- gss-client MIT's GSSAPI sample client and server: log in to a service with a Kerberos ticket, the way SSH or HTTP do underneath.
- oathtool Computes a one-time password (TOTP or HOTP) from a shared secret, as an authenticator app does.
- jq Reads JSON: pretty-prints it, picks fields out of it and filters arrays, as a REST API's answers need.
- xmllint Reads XML: pretty-prints it, checks it is well-formed, and picks nodes out of it, as a SAML message needs.
- xmlsec1 Signs and verifies XML digital signatures (XML-DSIG), the enveloped signature a SAML assertion carries.
- ansible Runs one module on every host of an inventory group over SSH, and shows what the inventory holds.
- ansible-playbook Runs a playbook: brings every host to the state it describes, or with --check reports what it would change.
Monitoring and logs
What do the devices report about themselves: counters, flows, logs?
- nstat Shows the kernel's network counters, and the change since the last run: packets, retransmits, SYN cookies.
- ifstat Shows each network card's packet and byte counters, and the change since the last run.
- snmpwalk Reads values from a device's SNMP agent: one with snmpget, a whole subtree with snmpwalk.
- softflowd Counts the flows crossing a card and exports them as NetFlow or IPFIX records to a collector.
- nfdump Lists, filters and ranks the flow records a collector (nfcapd) has stored.
- logger Writes a line to the system log, with a tag, facility and severity of your choice.
- suricata A network IDS/IPS: matches traffic against Suricata rules (signatures) and alerts, or drops the matching packets when inline.
- oscap Scans a host against a SCAP security baseline and reports each rule as pass or fail, with a severity.
- aide File-integrity monitor: records a fingerprint of chosen files, then reports which ones changed since.