20 Linux Network Commands Every Engineer Should Know (But Most Don’t)
When our production server goes down at 3 AM, we don’t want to spend time Googling “how to debug network issues”. You need to be well-versed in these commands.
I have been there, frantically troubleshooting connection issues with stakeholders breathing down my neck. After years of hands-on experience, here are the 20 network commands that have saved my life countless times.
Connection Checkers
1. <span>ping</span> Your first line of defense
ping google.com
ping -c 4 192.168.1.1
A classic command. If ping fails, you know the network path is broken.<span>-c</span> flag limits the count so you don’t have to watch packets indefinitely. It’s simple, but it immediately tells you if you can reach the target.
2. <span>traceroute</span> Where did the packets go?
traceroute google.com
When ping fails, traceroute shows you exactly where the packets are in the path. Each hop represents a router the packet has passed through. If you see an asterisk or timeout at a specific hop, you’ve found the culprit.
3. <span>mtr</span> The cool cousin of traceroute
mtr google.com
Think of mtr as an enhanced version of traceroute. It combines ping and traceroute, continuously updating packet loss statistics. Perfect for capturing intermittent network issues that traditional tools might miss.
DNS Troubleshooting
4. <span>dig</span> The Swiss Army knife of DNS
dig example.com
dig @8.8.8.8 example.com
dig example.com +short
dig is the go-to tool for DNS troubleshooting.<span>@</span> syntax allows you to query a specific DNS server, while <span>+short</span> gives concise IP addresses without extra information. When DNS behaves abnormally, dig tells you why.
5. <span>nslookup</span> The reliable old tool
nslookup example.com
Not as powerful as dig, but simpler and suitable for quick queries. Some old-school admins swear by it. I use dig, but nslookup gets the job done when you just need a quick DNS resolution check.
6. <span>host</span> Quick and simple DNS
host example.com
host -a example.com
Simpler than nslookup.<span>-a</span> flag shows all types of DNS records. Great for scripting, as the output is cleaner and easier to parse.
Network Configuration
7. <span>ifconfig</span> Know your network interfaces
ifconfig
ifconfig eth0
Displays network interfaces, IP addresses, MAC addresses, and statistics. Yes, it is being replaced by <span>ip</span>, but it is still ubiquitous and has a more intuitive syntax for beginners.
8. <span>ip</span> The modern way
ip addr show
ip route show
ip link set eth0 up
<span>ifconfig</span> is a more powerful and modern alternative. If you are serious about Linux networking, learn this command. It handles addresses, routes, and links in a unified manner.
9. <span>iwconfig</span> Wireless network specific
iwconfig wlan0
Similar to ifconfig, but specifically for wireless interfaces. Displays signal strength, frequency, encryption status, and all the information you need when Wi-Fi is unstable.
Port and Connection Management
10. <span>netstat</span> What are the actual connections?
netstat -tulpn
netstat -an | grep ESTABLISHED
Displays all active connections, listening ports, and routing tables.<span>-tulpn</span> flag shows TCP/UDP listening ports and their program names. Crucial for security audits and debugging what is actually running.
11. <span>ss</span> A faster alternative to netstat
ss -tulpn
ss -s
Does everything netstat does, but faster. Modern systems are moving to ss because it utilizes kernel data structures more efficiently. Same flags, better performance.
12. <span>nmap</span> Network scanner
nmap 192.168.1.0/24
nmap -sV localhost
The legendary port scanner. Discovers hosts, scans open ports, detects services and versions. A favorite among penetration testers, but also invaluable for legitimate network mapping and security audits.
13. <span>lsof</span> Which files are open?
lsof -i :80
lsof -i TCP
Lists open files, including network connections.<span>-i</span> flag filters internet connections. Perfect for finding the process occupying port 80 when you try to start a web server.
Traffic Analysis
14. <span>tcpdump</span> Capture everything
tcpdump -i eth0
tcpdump -i any port 80 -w capture.pcap
The ultimate packet sniffer. Captures raw network traffic for deep analysis.<span>-w</span> flag writes data to a file that you can later open in Wireshark. When strange things happen, tcpdump shows you what is actually being transmitted on the line.
15. <span>iftop</span> Real-time bandwidth monitoring
iftop -i eth0
Displays bandwidth usage in real-time, broken down by connection. It’s like <span>top</span>, but for network traffic. When something is draining your bandwidth, iftop tells you what it is.
16. <span>wget</span> Download and test
wget http://example.com/file.zip
wget --spider http://example.com
Everyone knows wget downloads files, but it is also perfect for testing HTTP connections and debugging web servers.<span>--spider</span> flag checks if a URL exists without downloading.
17. <span>curl</span> HTTP testing powerhouse
curl -I http://example.com
curl -X POST -d "key=value" http://api.example.com
More versatile than wget. Tests APIs, checks header information, supports various HTTP methods. If you work with web services, curl is essential.
Advanced Tools
18. <span>arp</span> Who’s on my local network?
arp -a
arp -d 192.168.1.100
Displays the ARP table, mapping IP addresses to MAC addresses. Used for detecting ARP spoofing attacks or finding devices on the local network.
19. <span>route</span> Where are the packets going?
route -n
route add default gw 192.168.1.1
Displays and manipulates the routing table. When packets cannot reach their destination, the routing table is often the culprit.<span>-n</span> flag shows numeric addresses instead of attempting to resolve hostnames.
20. <span>hostname</span> Who am I?
hostname
hostname -I
Simple but essential. Displays the system hostname and IP address.<span>-I</span> flag shows all network addresses. Great for scripting and quick identity checks.
Underappreciated Heroes
Bonus: <span>iperf</span> Test network performance
# On the server
iperf -s
# On the client
iperf -c serverIP
Measures the maximum TCP/UDP bandwidth between two hosts. Perfect for baseline testing when you suspect network performance issues.
Bonus: <span>ethtool</span> Hardware-level diagnostics
ethtool eth0
ethtool -S eth0
Displays detailed driver information, statistics, and diagnostics. Very useful when you need to verify link speed, duplex settings, or perform hardware-level troubleshooting.
Actual Troubleshooting Process
Here are the steps I actually use these tools for troubleshooting:
<span>ping</span>Can I reach the destination?<span>traceroute</span>Where does the failure occur?<span>dig</span>Is DNS working properly?<span>netstat</span>/<span>ss</span>What is listening and connected?<span>tcpdump</span>What is actually happening on the line?
This sequence resolves 90% of the network issues I encounter.
The Truth About Network Commands
You don’t need to memorize all these commands immediately. Start with the basics: ping, netstat, and ifconfig. As you encounter different issues, your toolbox will naturally expand.
But when production outages occur, you’ll be glad you took the time to learn these tools. The difference between engineers who know network commands and those who don’t? About three hours of downtime.
Bookmark this list. When the network inevitably has issues at the worst possible moment, your future self will thank you.
Now, go debug some network issues!