Published 1 minute ago

David has been lifelong fan of technology who loves putting his passion into words.

A journalist by training, he discovered the power of Unix-like operating systems when learning how to edit video on macOS, back when it was still called Mac OS X, in the mid-2000s.

A lover of retrocomputing, he appreciates the vast history of Unix that Linux continues today.

David holds a BA in communication from California State University, East Bay. His writing has appeared in Techopedia, TMCnet, The Motley Fool blog network, and HTG’s sister publication MUO, among others.

Your Linux distro comes pre-packaged with a wealth of powerful networking tools, including some that can diagnose common problems or help you monitor suspicious connections. But as with all things Linux, it’s hard to know where to start. So, here are some essential networking commands you need to know.

ping

The most important networking command in Linux might be ping. This command lets you check if a remote machine is responding to your requests. You can use ping to check if your internet connection is up or if a server has gone down, for example.

The basic usage is ping followed by an IP or DNS address:

ping howtogeek.com

ping will run forever until you press Ctrl+C, and then give you some statistics. You can set a count with the -c option, followed by a number. ping will then only ping a machine that number of times:

For example, to ping howtogeek.com four times:

ping -c 4 howtogeek.com

Don’t be alarmed if you don’t get a response. Many servers are set up to disregard ping requests for security. Try different machines if you want to make sure your internet connection is working.

Be careful about pinging some machines. Some administrators may interpret repeated pinging as a break-in attempt.

traceroute

While ping will tell you if a server is up and listening to ping requests, traceroute will show you the possible paths that your packets will take from your machine to their destination.

For example, to find the path from your machine to HTG:

traceroute howtogeek.com

You’ll see a list of hops fill the terminal. You’ll probably see a lot of blank entries. This is also due to many machines not listening to ping commands. traceroute works by setting an internet packet’s TTL, or "Time To Live" in increasing amounts so that they fail and return the location of servers along a possible route. Routes may change each time you run traceroute.

mtr

You might be confused about whether to use ping or traceroute. Why not use both? That’s what mtr, or My Traceroute, does. mtr combines ping and traceroute into one program. You get to see the route your packets take alongside some statistics. mtr runs continually. It also runs as a full-screen or as a GUI window.

What’s fascinating is to watch the statistics continually update. mtr shows the highest and lowest as well as the average and standard deviation, or how spread out these values are around the average. You’ll often see one or two hops that are slower than the others along the way. This means that there’s a bottleneck holding up traffic along the way.

mtr can also illustrate how paths through the network between machines can change with each run.

ip

ip has replaced ifconfig as the internet configuration tool in most major Linux distributions. You won’t have to do much with it, as your distro will handle most network devices by itself. You can see some useful information with ip. For example, to show your current IP addresses on your network devices:

ip address

You can also see the route where your packets will go:

ip route

Run by itself, ip will show the names of the network devices attached, their currently assigned IP addresses, as well as the subnet mask, the part that belongs to the network. Ethernet interfaces usually start with "en."

netstat

netstat will show the open connections on your machine without any arguments. The -r option will show the routing table.

You’ll most likely need to be root to run it for security:

sudo netstat

netstat will show the open sockets on your machine and which ones are listening. You can use this to monitor your connections and investigate anything that seems suspicious.

route

route, as the name implies, will show the routing table of any network interfaces on your machine. This will usually be the nearest router or switch. You can even add or delete routes manually, but you probably won’t need to under normal circumstances on a standard desktop machine.

The "default" line means the default route for network where requests will go. This is usually the nearest router or cable modem if it’s connected directly to your machine.

Most regular desktop systems will manage routing automatically, and there’s usually only one place for them to go anyway in residential networks, such as your Wi-Fi router.

ss

ss is a utility to dump statistics on any sockets on your machine to the terminal. This is helpful for finding any open network connections. As with netstat, it’s a useful tool to investigate your network connections and see if anything is connected to your machine that shouldn’t be. You can drill down your connections by protocol or socket.

ss and netstat are good ways to learn more about sockets or networking in general.

tcpdump

tcpdump is a packet sniffer that’s a terminal-based counterpart to the popular Wireshark program. With tcpdump, you can see the packets that your machine is sending out. Because this shows all the traffic on an interface, you usually need to be root to run it:

sudo tcpdump

This will show all packets being sent and received on the default network interface in real time. This is a useful diagnostic, but it can also be used to spy on internet traffic. Fortunately, it’s more common for internet traffic these days to be encrypted, so if someone got a hold of your transmissions, it would be useless unless they found a way to decode it.

dig

If you want to find out who is behind that domain name, you can use the dig command:

dig howtogeek.com

When you enter a domain name, dig will query DNS servers and display the results. DNS is what connects domain names to IP address. The domain names will be "authoritative," meaning it’s from the IP address of the requested domain, or "recursive," meaning that a server asked another DNS server what the address was.

The dig will show the IP address associated with the domain in the "answer" section. It will also show when you made the request and how long it took for the DNS server to respond at the end of the output.

host

host will also give you more information on a domain name, such as which servers handle email. As with dig, it will tell you the IP address of the domain name as well as which servers will handle its email.

This tool is simpler to read than dig since it has less information. You’ll notice that a lot of sites have multiple mail servers, including HTG. The multiple mail servers typically correspond to subdomains, such as sales.example.com for the example.com sales team, and engineering.example.com for the engineering department, and so on.

What you’re most interested in likely is just the first line, which tells you which address responded to the DNS request.

whois

whois will return the official records of a domain name, which can be useful if you need to get in touch with an admin at a website to report a problem. It’s also possible to abuse this, which is why it’s possible to register a domain name anonymously.

You’ll see a lot of the same information in dig or host, but you’ll also see the contact information of whoever registered the domain name. If the site owner doesn’t want their name and address accessible to anyone who knows how to run a whois query, the domain name will often be registered by a corporation that sells domain names, such as GoDaddy. You’ll also see when the domain name was registered and when it expires.

curl or wget

curl and wget are popular utilities for downloading files from servers using the command line. wget will automatically follow redirects, but curl is popular for scripting. Some tools, like Oh My Zsh will have you use one of them as part of the installation process.

To use curl to download the home page from howtogeek.com:

curl howtogeek.com

And for wget:

wget howtogeek.com

Be careful about crawling other peoples’ websites when using these utilities. It’s best to perform extensive downloads only when you have permission to do so. Otherwise, your activity might be interpreted as an attack on the site.

The main difference between the two commands is that curl is better suited to downloading individual files, while wget can follow links across a site to download other pages. You can even download a whole copy of a website using wget, which is useful for making a local backup if it ever goes down.