Linux IP and Netstat Commands: Essential Network Administration and Troubleshooting

Linux provides powerful built-in networking tools that allow administrators, engineers, security analysts, and enthusiasts to quickly inspect network configurations, active connections, routing tables, and service listeners. Understanding these commands is essential for troubleshooting connectivity issues, auditing systems, and managing Linux servers effectively.

In this post, we'll explore core IP and Netstat commands, explain what they do, and introduce additional high-value commands that every Linux user should know.

---

Display Network Interfaces

The following command lists all network interfaces currently available on the system:

ip link show

Example Output

1: lo: <LOOPBACK,UP,LOWER_UP>

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP>

3: wlan0: <BROADCAST,MULTICAST>

Why It's Useful

• Verify interface status
• Identify interface names
• Troubleshoot network adapter issues
• Check if interfaces are up or down

Bring an Interface Up

sudo ip link set eth0 up

Bring an Interface Down

sudo ip link set eth0 down

---

Display IP Address Configuration

To view assigned IPv4 and IPv6 addresses:

ip addr show

Short Version

ip a

Example Output

2: eth0

    inet 192.168.1.25/24

    inet6 fe80::250:56ff:feb9:1234/64

Why It's Useful

• Identify IP addresses
• View subnet information
• Verify DHCP assignments
• Confirm IPv6 configuration

View a Specific Interface

ip addr show eth0

---

View Routing Tables

Routing tables determine how network traffic reaches its destination.

ip route show

Short Version

ip r

Example Output

default via 192.168.1.1 dev eth0

192.168.1.0/24 dev eth0 proto kernel

Why It's Useful

• Verify default gateways
• Troubleshoot routing issues
• Analyze path selection
• Understand packet forwarding

Show Only Default Route

ip route | grep default

---

List Listening Internet Services

Netstat remains one of the most recognizable Linux networking utilities.

netstat -tupl

Parameter Breakdown

Option	Description
-t	TCP connections
-u	UDP connections
-p	Display PID/program
-l	Listening services

Example Output

tcp    0   0  0.0.0.0:22    0.0.0.0:*    LISTEN   1234/sshd

Why It's Useful

• Discover exposed services
• Verify application listeners
• Troubleshoot port conflicts
• Audit system security

---

View Active Network Connections

Display active TCP and UDP sessions:

netstat -tup

Example Output

tcp  0  0 192.168.1.25:22

       192.168.1.100:54321

       ESTABLISHED

Why It's Useful

• Review active connections
• Identify remote systems
• Detect suspicious sessions
• Investigate network activity

---

Recommended Modern Alternative: ss

Many Linux distributions consider ss the successor to netstat.

Show Listening Services

ss -tulnp

Show Active Connections

ss -tunap

Why Use ss?

• Faster than netstat
• Better performance on busy systems
• More detailed socket information
• Installed by default on most modern distributions

---

View ARP / Neighbor Table

Display network neighbor discovery information:

ip neigh

Example Output

192.168.1.1 dev eth0 lladdr 00:11:22:33:44:55 REACHABLE

Why It's Useful

• Identify devices on the local network
• Troubleshoot gateway communication
• Examine MAC address mappings

---

Test Network Connectivity

The classic connectivity testing tool:

ping google.com

Send Four Packets

ping -c 4 google.com

Why It's Useful

• Validate connectivity
• Measure latency
• Verify DNS resolution

---

Trace Packet Paths

Determine how traffic reaches a destination:

traceroute google.com

If traceroute is unavailable:

tracepath google.com

Why It's Useful

• Identify routing issues
• Find network bottlenecks
• Troubleshoot ISP connectivity problems

---

Check DNS Resolution

Display DNS lookup information:

dig microsoft.com

Display Only IP Address

dig microsoft.com +short

Alternative

nslookup microsoft.com

Why It's Useful

• Validate DNS records
• Troubleshoot name resolution failures
• Investigate domain infrastructure

---

Display Network Statistics

View interface statistics:

ip -s link

Why It's Useful

• Monitor packet counts
• Identify dropped packets
• Check transmission errors

Example

RX: bytes packets errors dropped

TX: bytes packets errors dropped

---

View Open Ports

Display listening ports with process details:

sudo lsof -i -P -n

Show Listening Ports Only

sudo lsof -iTCP -sTCP:LISTEN -P -n

Why It's Useful

• Audit exposed services
• Locate applications using ports
• Troubleshoot conflicts

---

Monitor Bandwidth Usage

Install and run:

iftop

Alternative Tools

nload

bmon

vnstat

Why It's Useful

• Real-time traffic monitoring
• Identify bandwidth-heavy hosts
• Detect unusual activity

---

View Kernel Network Information

Display socket statistics:

cat /proc/net/tcp

View interface information:

cat /proc/net/dev

Why It's Useful

• Low-level troubleshooting
• Script automation
• Advanced performance analysis

---

View Firewall Rules

Systems using iptables:

sudo iptables -L -n -v

Systems using nftables:

sudo nft list ruleset

Why It's Useful

• Verify firewall policies
• Troubleshoot blocked traffic
• Audit security settings

---

Find Established Connections Only

ss -ant | grep ESTAB

Or:

netstat -ant | grep ESTABLISHED

Why It's Useful

• Review active sessions
• Detect unauthorized connections
• Perform security auditing

---

Quick Network Administration Cheat Sheet

ip link show

ip addr show

ip route show

ip neigh

ss -tulnp

ss -tunap

netstat -tupl

netstat -tup

ping -c 4 google.com

traceroute google.com

dig google.com +short

ip -s link

lsof -i -P -n

iptables -L -n -v

nft list ruleset

Final Thoughts

The ip and netstat command suites are fundamental tools for Linux network administration. While the modern iproute2 utilities and ss command have largely replaced older networking tools, knowing both legacy and modern methods is invaluable for troubleshooting, security analysis, system audits, and day-to-day Linux administration.

Whether you're managing enterprise servers, performing security assessments, or simply learning Linux networking, mastering these commands will significantly improve your ability to diagnose and resolve network-related issues quickly and efficiently.

Linux - delgroup

The following is a Linux dictionary word of the day:delgroup. 

Linux delgroup Command: Remove Groups Safely and Efficiently

Managing user groups is a critical part of Linux system administration. Whether you're cleaning up unused groups, removing temporary project teams, or maintaining user permissions, the delgroup command provides a simple way to delete groups from a Linux system.

What Is the delgroup Command?

The delgroup command is used to remove an existing group from a Linux system. It is commonly found on Debian-based distributions such as:

• Ubuntu
• Debian
• Linux Mint
• Pop!_OS

When a group is no longer needed, delgroup removes the group's entry from system group databases.

Basic Syntax

delgroup [group_name]

Example:

delgroup itusersgroup

This command removes the group named itusersgroup from the system.

Why Remove a Group?

There are several reasons why administrators may delete groups:

• Cleaning up unused groups
• Removing temporary project teams
• Simplifying permission management
• Enforcing security best practices
• Eliminating outdated access structures

Regular group maintenance helps keep Linux systems organized and secure.

Example: Remove a Group

Suppose a project team called itusersgroup has been disbanded.

Verify the Group Exists

getent group itusersgroup

Example: 

itusersgroup:x:1005:

Best Practices

Before deleting any group:

• Verify the group's purpose.
• Review current group members.
• Check for file ownership dependencies.
• Document administrative changes.
• Confirm the group is no longer required.

Linux - depmod

The following is a Linux dictionary word of the day:

depmod – command utilized to list kernel module dependences and associated map files.

-a parameter to probe all modules.

-w parameter to show warnings of duplicate dependencies.

Example: depmod -a

Linux has a reputation for being elegant beneath the surface, and few commands embody that elegance more than depmod — the tool responsible for mapping out how kernel modules depend on one another. It doesn't shout, it doesn't brag, but every time your system loads a module cleanly, depmod has already done the groundwork.

What depmod Actually Does

At its core, depmod builds a dependency graph for all kernel modules on your system. Think of it as a librarian who organizes every module, notes which ones rely on others, and writes that information into map files that the kernel can quickly reference.

These map files typically include:

modules.dep - the full dependency list

modules.alias - hardware alias mappings

modules.symbols - exported symbols

modules.softdep - soft dependency hints

Without depmod, module loading would feel chaotic. With depmod, it's a symphony.

Why Kernel Dependencies Matter

Kernel modules aren't standalone actors. A filesystem module may rely on a crypto module. A network driver may depend on a PCI subsystem. A sound driver may need a mixer module.

depmod ensures:

Modules load in the correct order

• The kernel knows where each module lives
• Duplicate or conflicting dependencies get flagged
• Boot‑time module loading is predictable and fast
• It's the backstage crew that keeps the show running.

Key Parameters You'll Actually Use

-a parameter -  Probe All Modules

depmod -a tells the system to scan every module available and rebuild the entire dependency map.

This is the “refresh everything” command - perfect after installing new modules or updating the kernel.

-w parameter - Show Warnings

depmod -w surfaces warnings about duplicate dependencies or conflicting module relationships.

It's the equivalent of turning on the lights backstage and checking for loose cables.

When Should You Run depmod?

• After installing a new kernel
• After adding custom modules
• After removing modules
• When debugging module load failures
• When building your own kernel or experimenting with drivers

It's a maintenance ritual - quick, clean, and essential.

Final Takeaway

depmod is one of those Linux commands that rarely gets attention, yet it quietly ensures your system boots smoothly, loads drivers correctly, and maintains order in the kernel's modular universe. It's a backstage architect, a dependency cartographer, and a structural artist.

Linux - declare

The following is a Linux dictionary word of the day: declare

Bash's declare command is one of those quiet, powerful tools every Linux user should master. It gives you precision control over variables, functions, typing, scoping, and even arrays — all while staying POSIX‑friendly and blazing fast inside the shell.

What Is declare in Bash?

declare is a Bash built‑in command used to:

• Define variables
• Assign attributes (readonly, integer, array, export, etc.)
• Create functions
• Control variable scope inside scripts

Because declare is built directly into Bash, it executes faster than external commands and integrates tightly with the shell’s variable system.

Basic Usage: Declaring a Variable

Here’s the simplest example:

declare num

num=200

This does two aspects:

declare num tells Bash: “Create a variable named num.”

num=200 assigns a value.

But declare becomes far more powerful when you add attributes.

Useful Attributes You Should Know

Integer variables (-i) — Forces numeric evaluation

declare -i count=10+5

echo $count   # outputs 15

Readonly variables (-r) — Prevents modification

declare -r version="1.0"

Arrays (-a) — Creates indexed arrays

declare -a files=("log1" "log2" "log3")

Exported variables (-x) — Makes variables available to child processes

declare -x PATH

Function declarations (-f) — Lists or defines functions

declare -f

Why Linux Users Rely on declare

declare is especially useful in:

• System automation scripts
• Configuration management
• Package build scripts
• DevOps pipelines
• Performance‑sensitive Bash utilities

Its ability to enforce typing and structure helps prevent bugs and makes scripts more predictable — a huge win for Linux administrators.

Real‑World Example: Enforcing Integer Math

Without declare -i, Bash treats numbers as strings:

num="10"

echo $num+5   # outputs 10+5

With declare -i:

declare -i num=10

num+=5

echo $num     # outputs 15

This is essential when writing scripts that perform calculations, counters, loops, or resource monitoring.

Summary: Why You Should Use declare

declare gives one:

• Better variable control
• Cleaner, safer scripts
• Faster execution
• Built‑in typing and structure
• Linux‑friendly, POSIX‑aware behavior

Linux - ddrescue

The following is a Linux Dictionary word of the day: ddrescue.

GNU ddrescue is a powerful Linux data‑recovery utility that copies data from one block device to another while intelligently handling read errors. Unlike the classic dd command, ddrescue:

• Skips bad sectors automatically
• Retries only the damaged areas
• Uses a log file to track progress
• Can resume recovery at any time

This makes it ideal for failing HDDs, SSDs, USB drives, SD cards, and corrupted partitions.

1. -d parameter

• Direct disk access mode
• Forces ddrescue to bypass the OS cache
• Reads directly from the hardware

Useful for failing drives where caching may cause delays or hangs

Use when: recovering from physically damaged or unstable disks.

2. -f parameter

• Force writing to a block device
• Required when the output target is a raw device (e.g., /dev/sdb)
• Prevents accidental overwrites by requiring explicit confirmation
• Use when: cloning disk → disk.

3. -r[n] parameter

Retry bad sectors

• -r tells ddrescue to retry failed reads
• -r3 retries 3 times
• -r0 means no retries
• -r-1 means retry forever
• Used when: you want to squeeze every last readable byte from a failing disk.

Here’s a clean, production‑ready ddrescue command:

ddrescue -d -f /dev/mdev /dev/mdev2 ddclone.log

Breakdown:

-d → direct disk access

-f → force writing to block device

/dev/mdev → source disk

/dev/mdev2 → destination disk

ddclone.log → log file tracking recovery progress

Why the log file matters

If the recovery is interrupted, you can resume instantly:

ddrescue -d -f /dev/mdev /dev/mdev2 ddclone.log

ddrescue reads the log and continues exactly where it left off.

Best Practices for Safe Data Recovery

• Always clone first, never work on the failing disk directly
• Use a separate physical disk as the destination
• Keep the log file on a healthy drive
• Avoid mounting the failing disk
• Use -r3 or -r5 for moderate retries
• For severely damaged drives, use -r-1 (infinite retries) cautiously

Compared to other tools, ddrescue stands out because it:

• Automatically handles bad sectors
• Optimizes read order for maximum recovery
• Uses a persistent log file
• Works on any block device
• Is fast, reliable, and open‑source
• For Linux admins, technicians, and digital forensics specialists, ddrescue is simply indispensable.

Key Takeaways

ddrescue is the safest and most efficient Linux tool for disk cloning and recovery

• Use -d for direct disk access
• Use -f when writing to block devices
• Use -r[n] to retry bad sectors
• Always create and preserve a log file

Top 25 Lesser-Known Linux Commands Instructor Guide

Top 25 Lesser-Known Linux Commands Instructor Guide

https://www.amazon.com/dp/B0FNLRVBB2/

The following instructor guide reviews lesser known but useful Linux commands. These commands can be utilized for personal, educational, or corporate usage. It is envisioned that the instructor utilizes the material from this guide via a demonstration type format with each command reviewing the format, example, common options and brief pros and cons.

Contents:

Introduction

How to Use and Run Commands

Create Example Txt File

Create Example C File

bind

chage

cowsay

Ctrl+x+e

disown

factor

getconf

getopt

mpstat

mtr

ncdu

nl

nproc

pstree

pv

rev

shuf

ss

stat

strace

tr

tldr

watch

xxd

Conclusion

About the Author

Notes

Linux Commands for Ethical Hacking Instructor Guide

Linux Commands for Ethical Hacking Instructor Guide

https://www.amazon.com/dp/B0FBFVNWGC/

The following instructor guide reviews core and key Linux commands for ethical hacking. These commands can be utilized for personal, educational, or corporate usage. It is envisioned that the instructor utilizes the material from this guide via a demonstration type format with each command reviewing the format, brief pros and cons and example. Command contents are grouped by high-level subject matter.

Contents:

Introduction

How to Use and Run Commands

Create Example File

Exploitation

Forensics and Analysis

Network Scanning and Enumeration

Vulnerability Assessment Process

Conclusion

About the Author

Notes

Linux - dd

The following is a Linux Dictionary word of the day:

dd – command for data duplicator which converts and copies a file, writes disk headers and boot based records.

                Note: running this command with the incorrect parameters and data can delete data.

                if parameter for read from file.

                of parameter to write from file.

                Example copy data from sbin/mdev to sbin/mdev2:

                dd if=/sbin/mdev of=/sbin/mdev2

Linux - Dc

The following is a Linux Dictionary word of the day:

dc – command that runs a desk calculator.

+ = option for addition.

- = option for subtraction.

* = option for multiplication.

/ = option for division.

% = option to display reminder of division operation.

c = option to clear the stack.

f = option to display entire contents of the stack.

p = option which prints to the screen the first item in the stack.

Example:

dc

10

f

10

10+p

        

Karaoke Machine with 2 Wireless Microphones,Portable Karaoke Machine for Adults & Kids,Karaoke Microphone with PA System,Karaoke Speaker Supports for TWS,USB,FM,REC,AUX in,TF Card

https://amzn.to/4fYuGMM

As an Amazon Associate, I earn from qualifying purchases.

Linux Sed Instructor Guide

Linux Sed Instructor Guide https://www.amazon.com/dp/B0DRLCPYRK/

In a Linux system, utilizing sed to search as well as to find and replace is an essential part of working in the environment. Therefore, this instructor guide covers the most common ways to use sed. The commands can be utilized for personal, educational, or corporate usage. It is envisioned that the instructor utilizes the material from this guide via a demonstration type format.

Contents:

How to Use and Run Commands:

Create Example File:

Overview of Sed:

Sed Core Examples:

Sed Print Line Examples:

Sed Adding Aspects Examples:

Sed Manipulation of Lines Examples:

Sed Find and Replace Line Examples:

Sed Insert Line Examples:

Sed Updating File Examples:

Sed Line Number Examples:

Sed Line Deletion Examples:

About the Author:

Notes:

Brother P-Touch, PTM95, Handy Label Maker, 9 Type Styles, 8 Deco Mode Patterns, Navy Blue, Blue Gray

https://amzn.to/3VjjVfO

As an Amazon Associate, I earn from qualifying purchases.

Linux - Date

The following is a Linux Dictionary word of the day:

date – displays or changes the date & time.

-s = parameter for set.

Example: date

Example: Displays the date in the format of mm/dd/yy then the time in the format of hours:minutes:seconds:

date "+DATE: %m/%d/%y%nTIME: %H:%M:%S"

" – starts display line.

+DATE: option to concatenate the word DATE: on the output line.

%m option to display month.

%d option to display date.

%y option to display year.

%n option for a new line.

displays the date in the format as mm/dd/yy.

TIME: option to concatenate word TIME: on the output line.

%H: option for hour.

%M option for minutes.

%S option for seconds

" end of display line.

Brother P-Touch, PTM95, Handy Label Maker, 9 Type Styles, 8 Deco Mode Patterns, Navy Blue, Blue Gray

https://amzn.to/3VjjVfO

As an Amazon Associate, I earn from qualifying purchases.

Linux - Cut

The following is a Linux Dictionary word of the day:

cut – used for removing/parsing text in specific files or strings.

-d parameter which stands for delimiter.

-f parameter for file which then needs a number of how many lines to cut.

Example: using a , as a delimiter to cut the number of fields specified.

cut -d “,” -f 2 hello.c

Today Loves Food: Recipes from America’s Favorite Kitchen

https://amzn.to/3ZCoCml

As an Amazon Associate, I earn from qualifying purchases.

Linux - Curl

The following is a Linux Dictionary word of the day:

curl – display, upload or download data from one server to another using supported protocols (FTP, HTTP, IMAP, POP3, SCP, SFTP, TFTP, etc.).

Example displays contents of URL:

curl http://www.kmo.name

Example using curl with ftp to download all files in free directory that have oneill in the name and are a .pdf:

curl ftp://ftp.kmo.name/free/[oneill].pdf

Karaoke Machine with 2 Wireless Microphones,Portable Karaoke Machine for Adults & Kids,Karaoke Microphone with PA System,Karaoke Speaker Supports for TWS,USB,FM,REC,AUX in,TF Card

https://amzn.to/4fYuGMM

As an Amazon Associate, I earn from qualifying purchases.