Interfaces, routes, listening sockets, reachability and resolution. Each entry has a worked example and the flags worth knowing, and where one is easy to get wrong, the gotcha.
ip -br addrOne line per interface with its state and addresses.
lo UNKNOWN 127.0.0.1/8 ::1/128
eth0 UP 10.0.1.23/24 fe80::8ff:1ff:fe2a:3b4c/64-br-4 / -6addr show dev eth0ip routeShow the routing table: the default gateway and which interface each network uses.
default via 10.0.1.1 dev eth0 proto dhcp src 10.0.1.23 metric 100
10.0.1.0/24 dev eth0 proto kernel scope link src 10.0.1.23get ADDR-6ip route get <addr>Ask the kernel exactly how it would reach an address. Resolves 'which interface is this going out of?'
ip route get 10.20.0.1510.20.0.15 via 10.0.1.1 dev eth0 src 10.0.1.23 uid 1000from SRCip route add <network> via <gateway>Send traffic for one network through another gateway. It works at once and is gone after a reboot.
sudo ip route add 10.20.0.0/16 via 10.0.0.254 && ip route get 10.20.3.4del NETWORKreplace NETWORK via GWmetric Nip addr add ADDR/24 dev eth0Gotcha The gateway must be on a network the host is directly connected to, or you get "Nexthop has invalid gateway".
netplan applyUbuntu keeps the addresses and routes that survive a reboot as YAML in /etc/netplan. apply reads the files and sets the host up to match.
sudo netplan get/etc/netplan/60-static.yamladdresses: [10.0.0.50/24]routes: [{to: 10.20.0.0/16, via: 10.0.0.1}]sudo netplan tryGotcha apply removes whatever was added with ip addr add or ip route add. YAML is indented with spaces, never tabs.
ip -s linkInterface state, MTU and packet counters including errors and drops.
ip -s link show eth0-smtuss -tlnpList listening TCP sockets with the owning process. The fastest answer to 'is anything on port 8080?'
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=812,fd=6))
LISTEN 0 4096 127.0.0.1:8080 0.0.0.0:* users:(("server",pid=1432,fd=9))-t / -u-l-n-pGotcha 127.0.0.1:8080 accepts only local connections. If a proxy or container on another address cannot connect, check the bind address.
ss -sSocket summary: total TCP connections by state. A jump in TIME-WAIT or orphans shows connection churn.
-sss -tn dst <addr>Filter connections by peer or port, for example every open connection to the database.
ss -tn dst 10.0.2.40:5432dst ADDR[:PORT]sport = :443state establishednetstat -tulpnThe legacy equivalent of ss, still found on older hosts and in many runbooks.
-t -u-l-p -nlsof -iTCP:<port> -sTCP:LISTENFind the process that owns a listening port when you get 'address already in use'.
sudo lsof -iTCP:8080 -sTCP:LISTEN-iTCP:PORT-sTCP:LISTEN-P -nping -c <N> <host>Check basic reachability and round-trip latency with ICMP echo.
ping -c 4 10.0.2.404 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 0.412/0.497/0.611/0.071 ms-c N-W SEC-s SIZEGotcha Many clouds and firewalls drop ICMP. A failed ping does not prove the host is down; test the actual TCP port.
nc -zv <host> <port>Test whether a TCP port accepts connections without speaking the protocol.
nc -zv -w 3 db.internal 5432Connection to db.internal (10.0.2.40) 5432 port [tcp/postgresql] succeeded!-z-v-w SECGotcha 'Connection refused' means the host answered but nothing listens there. A timeout usually means a firewall dropped the packet.
bash -c '</dev/tcp/<host>/<port>'Port check with nothing but bash, for minimal containers that lack nc and curl.
timeout 3 bash -c '</dev/tcp/db.internal/5432' && echo open || echo closed/dev/tcp/H/Ptimeout 3tracepath <host>Show the routers on the way to a host, hop by hop, to see how far packets get when ping fails. It is part of the base system and needs no root.
tracepath -n example.com-n-m Ntraceroute -T -p 443Gotcha A hop in the middle that gives no reply only means that router does not answer. It matters when every hop from some point on is silent: that is where the packets stop.
mtr -rwc 20 <host>Combine ping and traceroute to show where along the path loss or latency appears.
mtr -rwc 20 api.example.com-r -w-c N-T -P 443Gotcha Loss at one middle hop that does not continue to later hops is just a router rate-limiting replies.
tcpdump -i <iface> -nn <filter>Capture packets to prove what is actually on the wire.
sudo tcpdump -i any -nn -c 20 port 53-i any-nn-c N-w FILE.pcaphost / port / tcpdig <name>Query DNS and see the full answer, including TTL, record type and the server that answered.
dig api.example.com;; ANSWER SECTION:
api.example.com. 300 IN A 203.0.113.10
;; SERVER: 127.0.0.53#53(127.0.0.53)status: NOERRORTTL (300)SERVERdig +short <name>Print just the answer values, ideal for scripts and quick checks.
dig +short api.example.com203.0.113.10+short+noall +answerdig @<server> <name>Ask a specific resolver. Comparing the local resolver with a public one separates cache problems from DNS problems.
dig @8.8.8.8 api.example.com +short@SERVER+tcpdig <name> <TYPE>Query a particular record type.
dig example.com MX +shortA / AAAACNAMEMX / TXTNS / SOAdig +trace <name>Resolve from the root servers down, bypassing caches, to see which delegation step breaks.
dig +trace api.example.com+tracedig -x <ip>Reverse lookup: which name is attached to an IP address (PTR record).
dig -x 203.0.113.10 +short-x ADDRnslookup <name> [server]The older lookup tool available almost everywhere, including Windows and many base images.
nslookup api.example.comSERVER-type=MXgetent hosts <name>Resolve a name exactly the way applications do: /etc/hosts, then DNS, in nsswitch.conf order.
getent hosts api.internal10.0.2.15 api.internalhostsahostsGotcha dig ignores /etc/hosts. When dig and the application disagree, getent tells you what the application sees.
cat /etc/hostsStatic name overrides consulted before DNS on most systems.
127.0.0.1 localhost
10.0.2.15 api.internalIP name [alias]Gotcha A forgotten test entry in /etc/hosts silently beats real DNS. It is a classic 'works on my machine' cause.
cat /etc/resolv.confWhich resolvers the host uses, the search domains, and options such as ndots.
nameserver 127.0.0.53
search corp.example.com
options edns0nameserversearchndots:NGotcha On systemd-resolved hosts 127.0.0.53 is a local stub; the real upstreams are in resolvectl status.
resolvectl statusShow per-link DNS servers for systemd-resolved, and flush its cache.
query NAMEflush-cachesstatisticsufw status verboseUbuntu's firewall front end: show and change rules.
sudo ufw allow 443/tcpstatus numberedallow PORT/PROTOallow from CIDR to any port Ndelete NGotcha Before ufw enable on a remote host, allow SSH first, or you lock yourself out.
iptables -L -n -v --line-numbersList iptables rules with packet counters, so you can see which rule is matching traffic.
sudo iptables -L INPUT -n -v --line-numbers-L CHAIN-n-v-SGotcha Rules match top to bottom and the first match wins. An early DROP makes a later ACCEPT dead code.
nft list rulesetShow the complete nftables configuration, the successor to iptables on current distributions.
sudo nft list rulesetlist table inet filter-afirewall-cmd --list-allfirewalld on RHEL-family hosts: show the active zone, services and ports.
sudo firewall-cmd --add-service=https --permanent && sudo firewall-cmd --reload--list-all--add-port=8080/tcp--permanentFree, instant, and it works on your phone. No signup: start as a guest and save your progress later.