Linux provides powerful built-in networking tools that allow administrators, engineers, security analysts, and enthusiasts to quickly inspect network configurations, active connections, routing tables, and service listeners. Understanding these commands is essential for troubleshooting connectivity issues, auditing systems, and managing Linux servers effectively.
In this post, we'll explore core IP and Netstat
commands, explain what they do, and introduce additional high-value commands
that every Linux user should know.
Display Network Interfaces
The following command lists all network interfaces currently
available on the system:
ip link show
Example Output
1: lo: <LOOPBACK,UP,LOWER_UP>
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP>
3: wlan0: <BROADCAST,MULTICAST>
Why It's Useful
- Verify
interface status
- Identify
interface names
- Troubleshoot
network adapter issues
- Check
if interfaces are up or down
Bring an Interface Up
sudo ip link set eth0 up
Bring an Interface Down
sudo ip link set eth0 down
Display IP Address Configuration
To view assigned IPv4 and IPv6 addresses:
ip addr show
Short Version
ip a
Example Output
2: eth0
inet 192.168.1.25/24
inet6 fe80::250:56ff:feb9:1234/64
Why It's Useful
- Identify
IP addresses
- View
subnet information
- Verify
DHCP assignments
- Confirm
IPv6 configuration
View a Specific Interface
ip addr show eth0
View Routing Tables
Routing tables determine how network traffic reaches its
destination.
ip route show
Short Version
ip r
Example Output
default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 proto kernel
Why It's Useful
- Verify
default gateways
- Troubleshoot
routing issues
- Analyze
path selection
- Understand
packet forwarding
Show Only Default Route
ip route | grep default
List Listening Internet Services
Netstat remains one of the most recognizable Linux
networking utilities.
netstat -tupl
Parameter Breakdown
|
Option |
Description |
|
-t |
TCP connections |
|
-u |
UDP connections |
|
-p |
Display PID/program |
|
-l |
Listening services |
Example Output
tcp 0 0
0.0.0.0:22 0.0.0.0:* LISTEN
1234/sshd
Why It's Useful
- Discover
exposed services
- Verify
application listeners
- Troubleshoot
port conflicts
- Audit
system security
View Active Network Connections
Display active TCP and UDP sessions:
netstat -tup
Example Output
tcp 0 0 192.168.1.25:22
192.168.1.100:54321
ESTABLISHED
Why It's Useful
- Review
active connections
- Identify
remote systems
- Detect
suspicious sessions
- Investigate
network activity
Recommended Modern Alternative: ss
Many Linux distributions consider ss the successor to
netstat.
Show Listening Services
ss -tulnp
Show Active Connections
ss -tunap
Why Use ss?
- Faster
than netstat
- Better
performance on busy systems
- More
detailed socket information
- Installed
by default on most modern distributions
View ARP / Neighbor Table
Display network neighbor discovery information:
ip neigh
Example Output
192.168.1.1 dev eth0 lladdr 00:11:22:33:44:55 REACHABLE
Why It's Useful
- Identify
devices on the local network
- Troubleshoot
gateway communication
- Examine
MAC address mappings
Test Network Connectivity
The classic connectivity testing tool:
ping google.com
Send Four Packets
ping -c 4 google.com
Why It's Useful
- Validate
connectivity
- Measure
latency
- Verify
DNS resolution
Trace Packet Paths
Determine how traffic reaches a destination:
traceroute google.com
If traceroute is unavailable:
tracepath google.com
Why It's Useful
- Identify
routing issues
- Find
network bottlenecks
- Troubleshoot
ISP connectivity problems
Check DNS Resolution
Display DNS lookup information:
dig microsoft.com
Display Only IP Address
dig microsoft.com +short
Alternative
nslookup microsoft.com
Why It's Useful
- Validate
DNS records
- Troubleshoot
name resolution failures
- Investigate
domain infrastructure
Display Network Statistics
View interface statistics:
ip -s link
Why It's Useful
- Monitor
packet counts
- Identify
dropped packets
- Check
transmission errors
Example
RX: bytes packets errors dropped
TX: bytes packets errors dropped
View Open Ports
Display listening ports with process details:
sudo lsof -i -P -n
Show Listening Ports Only
sudo lsof -iTCP -sTCP:LISTEN -P -n
Why It's Useful
- Audit
exposed services
- Locate
applications using ports
- Troubleshoot
conflicts
Monitor Bandwidth Usage
Install and run:
iftop
Alternative Tools
nload
bmon
vnstat
Why It's Useful
- Real-time
traffic monitoring
- Identify
bandwidth-heavy hosts
- Detect
unusual activity
View Kernel Network Information
Display socket statistics:
cat /proc/net/tcp
View interface information:
cat /proc/net/dev
Why It's Useful
- Low-level
troubleshooting
- Script
automation
- Advanced
performance analysis
View Firewall Rules
Systems using iptables:
sudo iptables -L -n -v
Systems using nftables:
sudo nft list ruleset
Why It's Useful
- Verify
firewall policies
- Troubleshoot
blocked traffic
- Audit
security settings
Find Established Connections Only
ss -ant | grep ESTAB
Or:
netstat -ant | grep ESTABLISHED
Why It's Useful
- Review
active sessions
- Detect
unauthorized connections
- Perform
security auditing
Quick Network Administration Cheat Sheet
ip link show
ip addr show
ip route show
ip neigh
ss -tulnp
ss -tunap
netstat -tupl
netstat -tup
ping -c 4 google.com
traceroute google.com
dig google.com +short
ip -s link
lsof -i -P -n
iptables -L -n -v
nft list ruleset
Final Thoughts
The ip and netstat command suites are
fundamental tools for Linux network administration. While the modern iproute2
utilities and ss command have largely replaced older networking tools,
knowing both legacy and modern methods is invaluable for troubleshooting,
security analysis, system audits, and day-to-day Linux administration.
Whether you're managing enterprise servers, performing
security assessments, or simply learning Linux networking, mastering these
commands will significantly improve your ability to diagnose and resolve
network-related issues quickly and efficiently.
