Home/Learn/Linux/Linux Networking — Tools & Diagnostics

Linux Networking — Tools & Diagnostics

Intermediate

Networking

Diagnose and configure Linux networking with ip, ss, netstat, curl, dig, tcpdump, and iptables. These tools are essential for debugging connectivity issues, inspecting sockets, and tracing requests.

Overview

Network debugging is one of the most common tasks for developers and DevOps engineers on Linux. Is the service listening? Can we reach the server? What port is blocked? What DNS resolves to? The modern Linux networking toolkit has moved from ifconfig/netstat (deprecated) to ip/ss. For application-level debugging, curl and wget; for DNS, dig and nslookup; for traffic capture, tcpdump; for firewall rules, iptables or nftables. Mastering these tools lets you diagnose "why can't my container reach the database" in minutes.

Interface & Routing — ip command

The ip command replaces ifconfig, route, and arp. It is the modern standard for network interface and routing management.

bash — ip command (modern ifconfig replacement)

# Show network interfaces and IP addresses
ip addr show                   # all interfaces
ip addr show eth0              # specific interface
ip -4 addr show                # IPv4 only

# Output example:
# 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500
#     inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic eth0
#     valid_lft 86397sec preferred_lft 86397sec

# Routing table
ip route show
# default via 192.168.1.1 dev eth0    â† default gateway
# 192.168.1.0/24 dev eth0             â† local subnet

# Add/remove routes
ip route add 10.0.0.0/8 via 192.168.1.1   # route 10.x.x.x through gateway
ip route del 10.0.0.0/8

# Bring interface up/down
ip link set eth0 up
ip link set eth0 down

# ARP cache (IP â†’ MAC mappings)
ip neigh show

# Network namespaces (used by Docker/Kubernetes)
ip netns list
ip netns exec container1 ip addr show

Socket Inspection — ss (and netstat)

ss (socket statistics) replaces netstat. It shows which ports are open, which processes own them, and what connections are established.

bash — ss, lsof, netcat for port inspection

# List all listening TCP ports
ss -tlnp
# -t: TCP only  -l: listening  -n: numeric (no DNS)  -p: show process

# Output:
# State  Recv-Q Send-Q Local Address:Port  Process
# LISTEN 0      128    0.0.0.0:22          pid=1234,fd=3  â† sshd
# LISTEN 0      511    0.0.0.0:80          pid=5678,fd=5  â† nginx
# LISTEN 0      128    127.0.0.1:5432      pid=9012,fd=6  â† postgres (local only)

# All sockets (TCP + UDP)
ss -anp

# Established connections
ss -tnp state established

# Find what is using port 8080
ss -tlnp | grep :8080
lsof -i :8080          # alternative: list open files on port 8080

# netstat equivalents (deprecated but still found everywhere):
# netstat -tlnp   â†’  ss -tlnp
# netstat -an     â†’  ss -an
# netstat -rn     â†’  ip route show

# Check if a remote port is reachable
nc -zv google.com 443      # netcat: -z (scan), -v (verbose)
# Connection to google.com 443 port [tcp/https] succeeded!

# Quick TCP connection test without netcat
timeout 3 bash -c "echo > /dev/tcp/google.com/443" && echo "open" || echo "closed"

DNS, HTTP & Packet Capture

dig for DNS debugging, curl for HTTP, tcpdump for raw packet capture. These cover 90% of production network debugging.

bash — dig, curl, tcpdump

# DNS debugging with dig
dig google.com                     # A record (IPv4)
dig google.com AAAA                # AAAA record (IPv6)
dig google.com MX                  # Mail exchange records
dig @8.8.8.8 google.com            # query specific DNS server (8.8.8.8 = Google)
dig +short google.com              # just the IP, no fluff
dig +trace google.com              # full delegation trace from root servers

# Reverse DNS lookup
dig -x 8.8.8.8                     # what hostname is 8.8.8.8?

# HTTP with curl
curl -v https://api.example.com/health        # verbose: shows headers
curl -I https://api.example.com              # HEAD request (headers only)
curl -H "Authorization: Bearer $TOKEN" https://api.example.com/data
curl -X POST -H "Content-Type: application/json" \
     -d '{"key":"value"}' https://api.example.com

# Measure response time
curl -w "\nTime: %{time_total}s\n" -o /dev/null -s https://api.example.com

# tcpdump — raw packet capture
tcpdump -i eth0 port 80 -w capture.pcap    # capture HTTP traffic to file
tcpdump -i any host 192.168.1.50           # traffic to/from specific host
tcpdump -i eth0 'tcp and port 443 and host api.example.com'
tcpdump -i eth0 -nn -X port 5432 | head   # show hex+ASCII, no name resolution
# Open .pcap in Wireshark for GUI analysis

Key Points to Remember

1ip replaces ifconfig and route; ss replaces netstat — prefer the modern tools.
2ss -tlnp shows all listening TCP ports with owning process — first step when "port already in use".
3dig @8.8.8.8 tests DNS resolution against a specific server, isolating local resolver issues.
4curl -v shows request/response headers — essential for debugging auth and redirect issues.
5tcpdump captures raw packets — use when you need to see exactly what is on the wire.
6lsof -i :PORT shows which process owns a port — useful when ss output lacks process info.

Interview Questions

How would you check which process is listening on port 8080?

How would you debug a DNS resolution failure?

Ask Aria about Linux Networking — Tools & Diagnostics

Your personal AI tutor — ask anything about this concept

Revision Status

Personal Notes

Discussion

Loading discussion…

Shell Scripting — Bash Fundamentals

systemd — Service Management