Linux networking commands cheat sheet
This sheet is deliberately all-modern: the iproute2 pair ip and ss replace every legacy net-tools command (ifconfig, netstat, route, arp). Net-tools stopped tracking kernel features years ago and is no longer installed by default on mainstream distros — a mapping table below translates anything older documentation throws at you.
Runtime versus persistent matters on every row that changes state: bare ip commands take effect instantly and evaporate at reboot, while NetworkManager (nmcli) or netplan write the configuration that survives. Test with ip, persist with nmcli is the usual sequence.
Interfaces, addresses and routes (ip)
| Task | Command | Notes |
|---|---|---|
| Quick address summary | ip -br addr | brief mode: one line per interface — the fastest 'what is my IP' read |
| Full detail for one interface | ip addr show dev eth0 | scopes, address lifetimes, secondary addrs, MAC |
| Link states at a glance | ip -br link | UP/DOWN/NO-CARRIER per port — cable vs config in one line |
| Bring an interface up or down | sudo ip link set dev eth0 up | down kills the link layer; mind your out-of-band console first |
| Add an IP address | sudo ip addr add 192.168.1.50/24 dev eth0 | instant but temporary; make persistent with nmcli or netplan |
| Show the routing table | ip route show | first line is normally the default route |
| Change the default gateway | sudo ip route replace default via 192.168.1.1 | replace swaps in place where plain add would fail with 'File exists' |
| Route a subnet via a gateway | sudo ip route add 10.20.0.0/16 via 192.168.1.254 | static route for a specific destination network |
| Neighbor / ARP table | ip neigh | REACHABLE and STALE entries; ip neigh flush all clears it |
| Per-interface error counters | ip -s link show dev eth0 | errors and dropped — first suspects for duplex or cable faults |
Net-tools to iproute2 translation
- ifconfig
- ip addr show (link state only: ip -br link)
- netstat -tulpn
- ss -tulpn
- route -n
- ip route show
- arp -a
- ip neigh
- iwconfig
- iw dev (wireless)
- brctl show
- ip link show type bridge or bridge link
Sockets and ports (ss)
| Task | Command | Notes |
|---|---|---|
| Listening TCP and UDP with owners | sudo ss -tulpn | t TCP, u UDP, l listening, p process, n numeric ports — THE port audit |
| Established and outbound too | ss -tupn | dropping l widens beyond listeners; add sudo to resolve every process name |
| Who owns a specific port | sudo ss -tulpn | grep ':443' | empty output means nothing is listening on it |
| Socket totals by state | ss -s | quick fd-leak read: thousands of TIME-WAIT or CLOSE-WAIT stand out |
| Filter by connection state | ss -tn state established | other useful states: time-wait, close-wait, listen |
Reachability, DNS and HTTP
| Task | Command | Notes |
|---|---|---|
| Four pings | ping -c 4 example.com | -c caps the count; the footer's loss % and rtt summary are the verdict |
| Hop-by-hop path | traceroute example.com | not preinstalled on Debian minimal — package: traceroute |
| Interactive path with loss stats | mtr example.com | ping meets traceroute, live; mtr -rw -c 20 prints a shareable report |
| Single TCP port test | nc -zv example.com 443 | -z scan only, -v verbose, -w 3 timeout; succeeded/refused beats ping for service checks |
| Minimal DNS answer | dig example.com +short | record data only — the scriptable form |
| Specific record type | dig MX example.com +short | swap in TXT, NS, AAAA, CNAME as needed |
| Ask a specific resolver | dig @1.1.1.1 example.com +short | isolates caching and propagation: compare your resolver vs a public one |
| Reverse DNS lookup | dig -x 93.184.216.34 +short | PTR record for an IP |
| HTTP response headers | curl -I https://example.com | HEAD request: status code, server, caching headers; some apps answer HEAD differently than GET |
| Download following redirects | curl -LO https://example.com/installer.sh | -O keeps the remote filename, -L follows redirects; add -s to silence progress |
| Resolver configuration | resolvectl status | per-link DNS servers and search domains under systemd-resolved |
| Flush the DNS cache | sudo resolvectl flush-caches | confirm with resolvectl statistics watching Cache Size drop |
NetworkManager, hostname and firewalls
| Task | Command | Notes |
|---|---|---|
| Adapter inventory | nmcli device status | DEVICE, TYPE, STATE and the connected profile per interface |
| Saved connection profiles | nmcli connection show | profiles, not hardware — one device may own several |
| Activate a profile | nmcli connection up "Wired connection 1" | connection down deactivates; autoconnect controls boot behavior |
| Set a static IPv4 profile | nmcli connection modify "Wired connection 1" ipv4.method manual ipv4.addresses 192.168.1.50/24 ipv4.gateway 192.168.1.1 | persistent; add ipv4.dns "1.1.1.1" and re-run connection up to apply |
| Host and OS facts | hostnamectl | static and transient hostname, kernel, virtualization, chassis |
| Rename the host | sudo hostnamectl set-hostname web01 | applies immediately to new shells; update /etc/hosts yourself |
| Firewall status (Ubuntu: ufw) | sudo ufw status verbose | enable once with ufw enable; open a port: ufw allow 22/tcp |
| Firewalld zone rules (RHEL: firewalld) | firewall-cmd --list-all | runtime view of the default zone: services, ports, interfaces |
| Open https permanently (firewalld) | firewall-cmd --permanent --add-service=https && firewall-cmd --reload | --permanent changes only apply after --reload; drop --permanent for a temporary runtime rule |
FAQ
How do I see which process is using port 8080?
sudo ss -tulpn | grep ':8080'. The flags decode as TCP + UDP, listening sockets, process names, numeric ports — and sudo is what lets ss attribute sockets owned by other users. The last column gives pid=(pid)/name. Empty output genuinely means nothing is listening on 8080. On systems with lsof installed, lsof -i :8080 -sTCP:LISTEN produces the same answer.
What replaced netstat and ifconfig on Linux?
The iproute2 suite: ss replaces netstat (ss -tulpn for netstat -tulpn) and ip replaces ifconfig (ip addr show), route (ip route show) and arp (ip neigh). Net-tools is unmaintained and no longer installed by default on mainstream distros, and it lacks newer features like policy routing and modern address scopes — new muscle memory should go straight to ip and ss.
Why can I ping a host but not connect to its port?
Ping tests ICMP reachability; your service speaks TCP on a specific port that something is filtering. Verify with nc -zv host 443: 'succeeded' means the TCP handshake completes, 'refused' means the host answered but nothing listens, and a timeout points at a firewall silently dropping. Work outward through the layers: local firewall (ufw status, firewall-cmd --list-all), then the server itself (ss -tulpn — is it bound to 127.0.0.1 instead of 0.0.0.0?), then cloud security groups.
Do I use ufw or firewalld?
It depends on distro: Ubuntu and Debian ship ufw, Fedora/RHEL/Rocky/Alma ship firewalld. Check which is active with systemctl is-active ufw firewalld. They are frontends to the same kernel netfilter, so never mix them. Idioms differ: ufw allow 22/tcp takes effect immediately, while firewalld separates runtime from permanent rules — firewall-cmd --permanent --add-service=https plus firewall-cmd --reload is the durable firewalld pair.
dig returns nothing while the website works — why?
Most likely you queried a record type the domain does not have (dig defaults to A; try +short against MX or TXT only if those records exist), or your resolver cached a negative answer. Compare resolvers directly: dig @1.1.1.1 example.com +short versus dig @your-resolver example.com +short. If the public one answers and yours does not, flushing the local cache with sudo resolvectl flush-caches settles it.
Related tools
- IPv4 subnet calculator — break any CIDR block into network, range, broadcast and usable hosts.
- IP range to CIDR — turn an arbitrary address range into its minimal covering CIDR blocks.
- VLSM calculator — split a block into right-sized subnets by host requirements.