Linux Networking Commands Explained — Diagnose, Monitor and Debug Like a Pro

#!/bin/bash
# Shows practical ip command usage for interface inspection
# Run these on any modern Linux host

# List all network interfaces with their IP addresses
# The 'addr' subcommand shows Layer 3 (IP) info bound to each interface
ip addr show

# Filter to just one interface — useful when you have many (eth0, lo, docker0, etc.)
ip addr show dev eth0

# Show the routing table — which gateway handles which destination networks
# This is the first thing to check when packets aren't leaving the host
ip route show

# Show the default gateway specifically — the 'exit door' for all unknown traffic
ip route show default

# Add a temporary static route for a specific subnet via a specific gateway
# This survives until reboot — use /etc/netplan or /etc/network/interfaces for persistence
ip route add 192.168.50.0/24 via 10.0.0.1 dev eth0

# Bring an interface DOWN and back UP without rebooting
# Useful after changing IP config or when an interface is in a bad state
ip link set eth0 down
ip link set eth0 up

# Check ARP cache — maps IP addresses to MAC addresses on your local network
# If a host's MAC shows as INCOMPLETE, ARP resolution is failing — suspect a firewall or VLAN issue
ip neigh show

#!/bin/bash
# Practical ss usage patterns for diagnosing connection issues

# Show all LISTENING TCP ports with the process that owns them
# -t = TCP only, -l = listening sockets, -n = numeric (don't resolve hostnames, much faster),
# -p = show the process (requires root or sudo for processes owned by other users)
ss -tlnp

# Show all ESTABLISHED connections — who is currently connected to this server
ss -tn state established

# Find what's using a specific port (e.g., 8080)
# The 'sport' filter means 'source port' — the local port your service is bound to
ss -tlnp sport = :8080

# Count connections per remote IP — useful for spotting a single client hammering your API
# This pipes ss output through awk to extract remote IPs and count occurrences
ss -tn state established | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -20

# Show all UDP sockets (DNS, DHCP, NTP all use UDP — don't forget to check these)
ss -ulnp

# Show connection summary statistics by state
# Huge TIME_WAIT count is normal; huge CLOSE_WAIT count may indicate a connection leak
ss -s

# The netstat equivalent for those on older systems without ss
# -a = all sockets, -n = numeric, -t = TCP, -u = UDP, -p = process
netstat -antp

#!/bin/bash
# Test each networking layer independently to isolate where failures occur

# ─── DNS TESTING WITH dig ───────────────────────────────────────────────

# Basic A record lookup — what IP does this hostname resolve to?
dig api.example.com A

# Query a SPECIFIC nameserver (e.g., Google's 8.8.8.8) to bypass your local resolver
# Useful when debugging 'works on my machine' DNS issues caused by local caching
dig @8.8.8.8 api.example.com A

# Trace the full DNS delegation from root servers down to the authoritative nameserver
# This is the gold standard for debugging DNS propagation issues
dig +trace api.example.com

# Check MX records (mail routing) — +short gives just the values, no noise
dig api.example.com MX +short

# Reverse DNS lookup — find the hostname for an IP address
dig -x 93.184.216.34 +short

# ─── HTTP/HTTPS TESTING WITH curl ───────────────────────────────────────

# Follow redirects (-L), show verbose output (-v) — see every step of the connection
curl -Lv https://api.example.com/health

# Time each phase of the connection — invaluable for performance diagnosis
# This custom format prints timing for each phase on separate lines
curl -o /dev/null -s -w "
DNS lookup:        %{time_namelookup}s
TCP connect:       %{time_connect}s
TLS handshake:     %{time_appconnect}s
Time to first byte: %{time_starttransfer}s
Total time:        %{time_total}s
HTTP status code:  %{http_code}
" https://api.example.com/health

# Test an API endpoint with a JSON POST body — simulates what your app does
curl -X POST https://api.example.com/users \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer your-token-here" \
  -d '{"username": "alice", "email": "alice@example.com"}' \
  --max-time 10  # fail after 10 seconds instead of hanging forever

# Test TLS certificate details — check expiry, issuer, and SANs
curl -vI https://api.example.com 2>&1 | grep -E '(subject|issuer|expire|SSL)'

# Skip TLS verification (ONLY for debugging self-signed certs — never in production)
curl -k https://internal-service.local/health

#!/bin/bash
# Trace packet paths and capture traffic for deep network diagnosis

# ─── PING ───────────────────────────────────────────────────────────────

# Basic connectivity check — send 5 packets, show statistics
ping -c 5 8.8.8.8

# Ping with a larger packet size to test MTU issues (1472 bytes + 28 byte IP/ICMP header = 1500 MTU)
# If this fails but small pings work, you likely have an MTU mismatch (common with VPNs)
ping -c 4 -s 1472 -M do 8.8.8.8  # -M do means 'don't fragment'

# ─── TRACEROUTE ─────────────────────────────────────────────────────────

# Standard traceroute using UDP probes
traceroute api.example.com

# Use TCP SYN probes on port 443 instead of UDP
# More likely to get through firewalls that block ICMP and UDP probes
traceroute -T -p 443 api.example.com

# mtr combines ping and traceroute — shows live packet loss per hop
# This is often the single best tool for diagnosing intermittent routing issues
mtr --report --report-cycles 20 api.example.com

# ─── TCPDUMP ────────────────────────────────────────────────────────────

# Capture all traffic on eth0 — CTRL+C to stop
# -n = don't resolve hostnames (faster), -i = interface
tcpdump -i eth0 -n

# Capture only HTTP traffic (port 80 or 443) to/from a specific host
# 'host' filters by IP in either direction
tcpdump -i eth0 -n host 10.0.1.20 and \( port 80 or port 443 \)

# Capture DNS queries — see what your server is resolving and to which nameserver
tcpdump -i eth0 -n port 53

# Save capture to a file for later analysis in Wireshark
# -w writes raw packets, -C 100 rotates files at 100MB to avoid filling the disk
tcpdump -i eth0 -n -w /tmp/capture.pcap -C 100 host 10.0.1.20

# Capture and print packet payloads in ASCII — see the actual HTTP request/response text
# -A = ASCII output, -s 0 = capture full packet (no truncation)
tcpdump -i eth0 -n -A -s 0 port 8080 | grep -E '(GET|POST|HTTP|Host:)'