# Linux networking commands cheat sheet

> Modern Linux networking: ip addr and routes, ss listening sockets, dig lookups, curl downloads, nmcli profiles, hostnamectl, ufw and firewalld

- Page URL: https://itinsighthub.com/linux/linux-networking/
- Markdown variant of this page: append `?format=md` to any URL on this site or send `Accept: text/markdown`.
- Full site index for AI assistants: https://itinsighthub.com/llms.txt
- Full site export: https://itinsighthub.com/llms-full.txt

# Linux networking commands cheat sheet

This sheet is deliberately all-modern: the iproute2 pair `ip` and `ss` replace every legacy net-tools command (`ifconfig`, `netstat`, `route`, `arp`). Net-tools stopped tracking kernel features years ago and is no longer installed by default on mainstream distros — a mapping table below translates anything older documentation throws at you.

Runtime versus persistent matters on every row that changes state: bare `ip` commands take effect instantly and evaporate at reboot, while NetworkManager (`nmcli`) or netplan write the configuration that survives. Test with ip, persist with nmcli is the usual sequence.

Published August 22, 2026

## Interfaces, addresses and routes (ip)

*All rows are iproute2. Reads run unprivileged; changes need root and are runtime-only unless persisted via nmcli/netplan*

| Task | Command | Notes |
| --- | --- | --- |
| Quick address summary | ip -br addr | brief mode: one line per interface — the fastest 'what is my IP' read |
| Full detail for one interface | ip addr show dev eth0 | scopes, address lifetimes, secondary addrs, MAC |
| Link states at a glance | ip -br link | UP/DOWN/NO-CARRIER per port — cable vs config in one line |
| Bring an interface up or down | sudo ip link set dev eth0 up | down kills the link layer; mind your out-of-band console first |
| Add an IP address | sudo ip addr add 192.168.1.50/24 dev eth0 | instant but temporary; make persistent with nmcli or netplan |
| Show the routing table | ip route show | first line is normally the default route |
| Change the default gateway | sudo ip route replace default via 192.168.1.1 | replace swaps in place where plain add would fail with 'File exists' |
| Route a subnet via a gateway | sudo ip route add 10.20.0.0/16 via 192.168.1.254 | static route for a specific destination network |
| Neighbor / ARP table | ip neigh | REACHABLE and STALE entries; ip neigh flush all clears it |
| Per-interface error counters | ip -s link show dev eth0 | errors and dropped — first suspects for duplex or cable faults |

Net-tools to iproute2 translation

- **ifconfig:** ip addr show (link state only: ip -br link)
- **netstat -tulpn:** ss -tulpn
- **route -n:** ip route show
- **arp -a:** ip neigh
- **iwconfig:** iw dev (wireless)
- **brctl show:** ip link show type bridge or bridge link

## Sockets and ports (ss)

*ss reads kernel socket state directly. Process names (-p) for other users' sockets require root*

| Task | Command | Notes |
| --- | --- | --- |
| Listening TCP and UDP with owners | sudo ss -tulpn | t TCP, u UDP, l listening, p process, n numeric ports — THE port audit |
| Established and outbound too | ss -tupn | dropping l widens beyond listeners; add sudo to resolve every process name |
| Who owns a specific port | sudo ss -tulpn \| grep ':443' | empty output means nothing is listening on it |
| Socket totals by state | ss -s | quick fd-leak read: thousands of TIME-WAIT or CLOSE-WAIT stand out |
| Filter by connection state | ss -tn state established | other useful states: time-wait, close-wait, listen |

## Reachability, DNS and HTTP

*Diagnosis ladder: ping for reachability, mtr for the path, nc for a single port, dig for naming, curl for HTTP behavior*

| Task | Command | Notes |
| --- | --- | --- |
| Four pings | ping -c 4 example.com | -c caps the count; the footer's loss % and rtt summary are the verdict |
| Hop-by-hop path | traceroute example.com | not preinstalled on Debian minimal — package: traceroute |
| Interactive path with loss stats | mtr example.com | ping meets traceroute, live; mtr -rw -c 20 prints a shareable report |
| Single TCP port test | nc -zv example.com 443 | -z scan only, -v verbose, -w 3 timeout; succeeded/refused beats ping for service checks |
| Minimal DNS answer | dig example.com +short | record data only — the scriptable form |
| Specific record type | dig MX example.com +short | swap in TXT, NS, AAAA, CNAME as needed |
| Ask a specific resolver | dig @1.1.1.1 example.com +short | isolates caching and propagation: compare your resolver vs a public one |
| Reverse DNS lookup | dig -x 93.184.216.34 +short | PTR record for an IP |
| HTTP response headers | curl -I https://example.com | HEAD request: status code, server, caching headers; some apps answer HEAD differently than GET |
| Download following redirects | curl -LO https://example.com/installer.sh | -O keeps the remote filename, -L follows redirects; add -s to silence progress |
| Resolver configuration | resolvectl status | per-link DNS servers and search domains under systemd-resolved |
| Flush the DNS cache | sudo resolvectl flush-caches | confirm with resolvectl statistics watching Cache Size drop |

## NetworkManager, hostname and firewalls

*Desktops and servers alike run NetworkManager on Ubuntu and Fedora families; ufw ships on Ubuntu/Debian, firewalld on Fedora/RHEL/Rocky/Alma*

| Task | Command | Notes |
| --- | --- | --- |
| Adapter inventory | nmcli device status | DEVICE, TYPE, STATE and the connected profile per interface |
| Saved connection profiles | nmcli connection show | profiles, not hardware — one device may own several |
| Activate a profile | nmcli connection up "Wired connection 1" | connection down deactivates; autoconnect controls boot behavior |
| Set a static IPv4 profile | nmcli connection modify "Wired connection 1" ipv4.method manual ipv4.addresses 192.168.1.50/24 ipv4.gateway 192.168.1.1 | persistent; add ipv4.dns "1.1.1.1" and re-run connection up to apply |
| Host and OS facts | hostnamectl | static and transient hostname, kernel, virtualization, chassis |
| Rename the host | sudo hostnamectl set-hostname web01 | applies immediately to new shells; update /etc/hosts yourself |
| Firewall status (Ubuntu: ufw) | sudo ufw status verbose | enable once with ufw enable; open a port: ufw allow 22/tcp |
| Firewalld zone rules (RHEL: firewalld) | firewall-cmd --list-all | runtime view of the default zone: services, ports, interfaces |
| Open https permanently (firewalld) | firewall-cmd --permanent --add-service=https && firewall-cmd --reload | --permanent changes only apply after --reload; drop --permanent for a temporary runtime rule |

## References

- [ip(8) man page](https://man7.org/linux/man-pages/man8/ip.8.html) — canonical reference for address, link and route operations.
- [ss(8) man page](https://man7.org/linux/man-pages/man8/ss.8.html) — socket inspection flags used in the table above.

## FAQ

**How do I see which process is using port 8080?**

sudo ss -tulpn | grep ':8080'. The flags decode as TCP + UDP, listening sockets, process names, numeric ports — and sudo is what lets ss attribute sockets owned by other users. The last column gives pid=(pid)/name. Empty output genuinely means nothing is listening on 8080. On systems with lsof installed, lsof -i :8080 -sTCP:LISTEN produces the same answer.

**What replaced netstat and ifconfig on Linux?**

The iproute2 suite: ss replaces netstat (ss -tulpn for netstat -tulpn) and ip replaces ifconfig (ip addr show), route (ip route show) and arp (ip neigh). Net-tools is unmaintained and no longer installed by default on mainstream distros, and it lacks newer features like policy routing and modern address scopes — new muscle memory should go straight to ip and ss.

**Why can I ping a host but not connect to its port?**

Ping tests ICMP reachability; your service speaks TCP on a specific port that something is filtering. Verify with nc -zv host 443: 'succeeded' means the TCP handshake completes, 'refused' means the host answered but nothing listens, and a timeout points at a firewall silently dropping. Work outward through the layers: local firewall (ufw status, firewall-cmd --list-all), then the server itself (ss -tulpn — is it bound to 127.0.0.1 instead of 0.0.0.0?), then cloud security groups.

**Do I use ufw or firewalld?**

It depends on distro: Ubuntu and Debian ship ufw, Fedora/RHEL/Rocky/Alma ship firewalld. Check which is active with systemctl is-active ufw firewalld. They are frontends to the same kernel netfilter, so never mix them. Idioms differ: ufw allow 22/tcp takes effect immediately, while firewalld separates runtime from permanent rules — firewall-cmd --permanent --add-service=https plus firewall-cmd --reload is the durable firewalld pair.

**dig returns nothing while the website works — why?**

Most likely you queried a record type the domain does not have (dig defaults to A; try +short against MX or TXT only if those records exist), or your resolver cached a negative answer. Compare resolvers directly: dig @1.1.1.1 example.com +short versus dig @your-resolver example.com +short. If the public one answers and yours does not, flushing the local cache with sudo resolvectl flush-caches settles it.

## Related tools

- [IPv4 subnet calculator](https://itinsighthub.com/subnet-calculator/) — break any CIDR block into network, range, broadcast and usable hosts.
- [IP range to CIDR](https://itinsighthub.com/ip-range-to-cidr/) — turn an arbitrary address range into its minimal covering CIDR blocks.
- [VLSM calculator](https://itinsighthub.com/vlsm-calculator/) — split a block into right-sized subnets by host requirements.

---

© 2026 ITInsightHub · [About](https://itinsighthub.com/about/) · [Contact](https://itinsighthub.com/contact/) · [Privacy](https://itinsighthub.com/privacy/)