Linux Networking Tools Cheatsheet

# Debian / Ubuntu
apt install iproute2 net-tools iputils-ping traceroute mtr nmap tcpdump netcat-openbsd dnsutils iperf3
 
# RHEL / Rocky / AlmaLinux
dnf install iproute net-tools iputils traceroute mtr nmap tcpdump nc bind-utils iperf3

ip a                                      # Show all IP addresses (ip addr show)
ip a show eth0                            # Show IP for specific interface
ip link show                              # Show interface status (up/down, MAC)
ip link set eth0 up                       # Bring interface up
ip link set eth0 down                     # Bring interface down
 
# Modifying IPs (Temporary, lost on reboot)
ip addr add 192.168.1.50/24 dev eth0      # Add IP to interface
ip addr del 192.168.1.50/24 dev eth0      # Remove IP from interface
ip -s link                                # Show network statistics (errors, drops)

ip r                                      # Show routing table (ip route)
ip route get 8.8.8.8                      # Show which route will be used for an IP
ip route add default via 192.168.1.1      # Add default gateway
ip route add 10.0.0.0/8 via 192.168.1.254 # Add static route
ip route del 10.0.0.0/8                   # Delete static route

ss -tuln                                  # Show listening TCP/UDP ports (numeric)
ss -tulnp                                 # Show listening ports with Process ID/Name (requires root)
ss -tun                                   # Show established connections
ss -s                                     # Show socket statistics summary
ss -dst 192.168.1.10                      # Show connections to a specific destination
ss -state time-wait                       # Show ports in specific state

ping 8.8.8.8                              # Standard ICMP ping
ping -c 4 8.8.8.8                         # Ping exactly 4 times
ping -i 0.2 8.8.8.8                       # Ping fast (0.2 seconds interval, root only)
ping -s 1500 8.8.8.8                      # Ping with custom packet size (test MTU)

traceroute google.com                     # Trace path using UDP
traceroute -I google.com                  # Trace path using ICMP (like Windows tracert)
traceroute -T -p 443 google.com           # Trace path using TCP port 443 (bypass ICMP blocks)
traceroute -n google.com                  # Don't resolve DNS (faster)

mtr google.com                            # Real-time interactive UI
mtr -n google.com                         # No DNS resolution
mtr -T -P 443 google.com                  # Use TCP on port 443
mtr -rw google.com                        # Generate report output (good for sharing)

nmap 192.168.1.10                         # Standard top 1000 TCP ports scan
nmap -p 80,443 192.168.1.10               # Scan specific ports
nmap -p- 192.168.1.10                     # Scan all 65535 ports
nmap -sn 192.168.1.0/24                   # Ping sweep (find active hosts on subnet)
nmap -A 192.168.1.10                      # Aggressive scan (OS, versions, scripts)
nmap -sV 192.168.1.10                     # Probe open ports to determine service/version
nmap -sU 192.168.1.10                     # Scan UDP ports (requires root, slow)

tcpdump -i eth0                           # Listen on eth0
tcpdump -i any                            # Listen on all interfaces
tcpdump -n -i eth0                        # Don't resolve hostnames/ports (faster)
tcpdump -nn -i eth0                       # Don't resolve hostnames or protocols
tcpdump -i eth0 port 80                   # Filter by specific port
tcpdump -i eth0 host 192.168.1.10         # Filter by IP address
tcpdump -i eth0 src 10.0.0.1              # Filter by source IP
tcpdump -i eth0 dst 10.0.0.2              # Filter by destination IP
tcpdump -i eth0 icmp                      # Show only ping traffic
tcpdump -i eth0 -w capture.pcap           # Write output to file (for Wireshark)
tcpdump -r capture.pcap                   # Read from pcap file
tcpdump -i eth0 -A port 80                # Print packet contents in ASCII

# Testing connectivity
nc -vz 192.168.1.10 443                   # Test if TCP port 443 is open (-v verbose, -z zero-I/O)
nc -vzu 192.168.1.10 53                   # Test if UDP port 53 is open
 
# Listening / Testing firewalls
nc -l -p 8080                             # Listen on TCP port 8080 (Debian/netcat-traditional)
nc -lvnp 8080                             # Listen verbose, no DNS, port 8080
 
# Simple file transfer
nc -l -p 8080 > received_file.txt         # Receiver
nc 192.168.1.10 8080 < file.txt           # Sender

dig example.com                           # Get A records
dig example.com ANY                       # Get all records
dig example.com MX                        # Get MX (Mail) records
dig +short example.com                    # Only output the IPs
dig @1.1.1.1 example.com                  # Query specific DNS server
dig -x 8.8.8.8                            # Reverse DNS lookup
nslookup example.com                      # Basic lookup

# Requires iperf3 installed on both ends
iperf3 -s                                 # Start server on target machine (listens on 5201)
iperf3 -c 192.168.1.10                    # Start client, connect to server
iperf3 -c 192.168.1.10 -R                 # Reverse test (server sends to client)
iperf3 -c 192.168.1.10 -u -b 100M         # UDP test at 100 Mbps
iperf3 -c 192.168.1.10 -P 4               # Run 4 parallel streams

ip neigh show                             # Show ARP table
arp -a                                    # Legacy way to show ARP table
ip neigh flush all                        # Clear ARP cache