Essential Linux Networking Commands: Complete Reference Guide 2026

Networking is the circulatory system of modern IT infrastructure. Every service, application, and user interaction depends on network connectivity. When something goes wrong — a website is unreachable, DNS resolution fails, latency spikes, or packets are being dropped — you need to diagnose the problem quickly and accurately from the command line.

This comprehensive reference covers the essential Linux networking commands that every system administrator, DevOps engineer, and network troubleshooter needs to know in 2026. From basic connectivity testing to advanced packet analysis, these commands form the toolkit for diagnosing and resolving any network issue you will encounter.

Network Interface Configuration

Understanding and configuring network interfaces is the foundation of Linux networking. These commands show you what interfaces exist, how they are configured, and let you make changes.

ip — The Modern Network Swiss Army Knife

The ip command has replaced the older ifconfig command on all modern Linux distributions. It provides comprehensive control over network interfaces, addresses, routes, and tunnels.

• ip addr show (or ip a) — Display all network interfaces and their IP addresses. This is the first command you run when troubleshooting: it shows interface names, IPv4/IPv6 addresses, MAC addresses, and interface state (UP/DOWN)
• ip addr show eth0 — Show details for a specific interface
• ip link show — Display interface link-layer information (MAC addresses, MTU, state)
• ip link set eth0 up — Bring an interface up
• ip link set eth0 down — Take an interface down
• ip addr add 192.168.1.100/24 dev eth0 — Add an IP address to an interface
• ip addr del 192.168.1.100/24 dev eth0 — Remove an IP address from an interface

Understanding ip addr Output

Routing and Gateway Commands

Routing determines how packets travel from your server to their destination. Misconfigured routing is one of the most common causes of connectivity issues.

• ip route show (or ip r) — Display the routing table. Shows the default gateway, directly connected networks, and any static routes
• ip route get 8.8.8.8 — Show which route a specific destination would use. Extremely useful for debugging routing decisions
• ip route add 10.0.0.0/8 via 192.168.1.1 — Add a static route
• ip route del 10.0.0.0/8 — Remove a static route
• ip route add default via 192.168.1.1 — Set the default gateway
• traceroute destination (or tracepath) — Trace the path packets take to a destination, showing every router (hop) along the way. Essential for identifying where in the network a problem occurs
• mtr destination — Combines traceroute and ping into a single real-time diagnostic tool. Shows packet loss and latency at each hop. This is the most powerful route diagnostic tool available

Connectivity Testing

These commands answer the most basic networking question: "Can I reach this destination?"

ping — The Universal Connectivity Test

• ping 8.8.8.8 — Test basic IP connectivity to Google's DNS. If this works, your internet connection is functional
• ping -c 5 192.168.1.1 — Send exactly 5 ping packets (useful in scripts)
• ping -i 0.2 hostname — Ping every 0.2 seconds instead of the default 1 second (requires root)
• ping -s 1400 hostname — Send larger packets to test MTU issues
• ping6 ::1 — Ping using IPv6

Interpreting Ping Output

curl and wget — HTTP Connectivity

• curl -I https://example.com — Fetch only HTTP headers (check if a web server responds)
• curl -o /dev/null -s -w "%{http_code}" https://example.com — Get only the HTTP status code (useful in scripts)
• curl -v https://example.com — Verbose mode showing TLS handshake, headers, and response
• wget --spider https://example.com — Check if a URL is reachable without downloading

DNS Diagnostics

DNS (Domain Name System) translates domain names to IP addresses. DNS failures are the cause of an enormous percentage of "the internet is broken" reports. These commands help you diagnose DNS issues quickly.

• dig example.com — Query DNS records with detailed output including TTL, record type, and response time. The most comprehensive DNS diagnostic tool
• dig +short example.com — Show only the answer (just the IP address)
• dig example.com MX — Query specific record types (MX for mail, AAAA for IPv6, TXT for SPF/DKIM)
• dig @8.8.8.8 example.com — Query a specific DNS server (bypass your system resolver)
• dig +trace example.com — Trace the full DNS resolution path from root servers to authoritative nameservers
• nslookup example.com — Simpler DNS query tool (available on most systems including Windows)
• host example.com — Quick DNS lookup with clean output
• resolvectl status — Show systemd-resolved configuration (modern systems)

Common DNS Record Types

Port and Connection Analysis

Understanding which ports are open, which services are listening, and who is connected is essential for both troubleshooting and security.

ss — Socket Statistics (Modern)

The ss command has replaced netstat on modern systems. It is faster and provides more detailed information.

• ss -tuln — Show all listening TCP and UDP ports with numeric addresses. This is the "what is my server exposing?" command
• ss -tunp — Show established connections with process names (requires root for -p)
• ss -s — Display socket statistics summary (total connections by state)
• ss state established — Show only established connections
• ss -tuln sport = :80 — Filter for a specific port
• ss -o state time-wait — Show TIME_WAIT connections (useful for diagnosing connection exhaustion)

netstat — Legacy but Still Useful

• netstat -tuln — Equivalent to ss -tuln (available on older systems)
• netstat -rn — Display routing table (equivalent to ip route show)
• netstat -s — Protocol statistics (TCP retransmissions, errors, etc.)

Testing Port Connectivity

• nc -zv hostname 443 — Test if a specific port is open (netcat)
• nc -zv hostname 80-100 — Scan a range of ports
• telnet hostname 25 — Connect to a specific port (useful for testing SMTP, HTTP manually)
• nmap -sT hostname — Comprehensive port scan (more powerful than nc, must install separately)
• nmap -sV hostname — Detect service versions on open ports

Firewall Management

Firewalls control which traffic is allowed in and out of your server. Misconfigured firewalls are one of the top causes of "my service is running but nobody can connect."

FirewallD (RHEL/AlmaLinux/Rocky/Fedora)

• firewall-cmd --state — Check if firewall is running
• firewall-cmd --list-all — Show all rules for the default zone
• firewall-cmd --permanent --add-port=8080/tcp — Open a port permanently
• firewall-cmd --permanent --add-service=https — Allow a service by name
• firewall-cmd --reload — Apply permanent changes

UFW (Ubuntu/Debian)

• ufw status verbose — Show all firewall rules
• ufw allow 443/tcp — Allow incoming TCP on port 443
• ufw deny from 10.0.0.0/8 — Block an IP range
• ufw enable / ufw disable — Toggle the firewall

iptables (Low-Level)

• iptables -L -n -v — List all rules with packet/byte counters
• iptables -A INPUT -p tcp --dport 80 -j ACCEPT — Add an allow rule
• iptables -A INPUT -s 10.0.0.0/8 -j DROP — Block an IP range

Bandwidth and Traffic Monitoring

Monitoring network bandwidth helps identify bottlenecks, unusual traffic patterns, and potential security issues.

• iftop — Real-time bandwidth monitoring per connection (like top for network). Shows which connections are consuming the most bandwidth
• nethogs — Group bandwidth usage by process (shows which application is using the network)
• vnstat — Long-term traffic monitoring with hourly, daily, and monthly statistics
• iperf3 -s (server) / iperf3 -c server-ip (client) — Measure network throughput between two hosts. Essential for validating bandwidth capacity
• tc qdisc show — Show traffic control and queuing disciplines (advanced QoS)

Packet Capture and Analysis

When higher-level tools cannot identify the problem, packet capture lets you see exactly what is happening on the wire.

• tcpdump -i eth0 — Capture all packets on an interface
• tcpdump -i eth0 port 80 — Capture only HTTP traffic
• tcpdump -i eth0 host 192.168.1.100 — Capture traffic to/from a specific host
• tcpdump -i eth0 -w capture.pcap — Save capture to a file for later analysis (open in Wireshark)
• tcpdump -i eth0 -c 100 — Capture exactly 100 packets then stop
• tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0' — Capture only SYN packets (new connections)

Network Troubleshooting Workflow

When diagnosing network issues, follow this systematic approach:

1. Check local interface: ip addr show — Is the interface up? Does it have an IP?
2. Test local connectivity: ping gateway-ip — Can you reach your default gateway?
3. Test internet connectivity: ping 8.8.8.8 — Can you reach the internet by IP?
4. Test DNS resolution: dig example.com — Is DNS working?
5. Check routing: ip route get destination-ip — Is traffic going the right way?
6. Check firewall: firewall-cmd --list-all or iptables -L -n — Is the firewall blocking traffic?
7. Check services: ss -tuln — Is the service actually listening?
8. Trace the path: mtr destination — Where in the network is the problem?
9. Capture packets: tcpdump — What is actually happening on the wire?

Quick Reference Table

Frequently Asked Questions

What is the difference between ip and ifconfig?

ip is the modern replacement for ifconfig. The ifconfig command is deprecated on most modern Linux distributions and may not be installed by default. Always use ip addr instead of ifconfig, ip route instead of route, and ss instead of netstat.

How do I find which process is using a specific port?

Run ss -tulnp | grep :PORT (replace PORT with the port number). The -p flag shows the process name and PID. You may need root/sudo to see process information for services running as other users.

How do I check if a remote port is open?

Use nc -zv hostname port for a quick test. For more thorough scanning, use nmap hostname. If nc reports "Connection refused," the port is closed but the host is reachable. If it times out, either the port is filtered by a firewall or the host is unreachable.

What does "Connection refused" mean vs "Connection timed out"?

"Connection refused" means the host received your connection request but no service is listening on that port — the host is reachable but the service is not running. "Connection timed out" means the host never responded — either it is down, unreachable, or a firewall is silently dropping packets.

How do I find my public IP address from the command line?

Run curl -s ifconfig.me or curl -s icanhazip.com. These services return your public-facing IP address. For finding your local/private IP, use ip addr show and look for inet addresses on your primary interface.

Related Resources

• Linux Networking Fundamentals — Complete networking eBook
• SSH Mastery: Secure Remote Administration — Remote administration over network
• How to Secure Your SSH Server in 5 Steps — Network service security
• Browse all 205+ free IT cheat sheets