Network Troubleshooting Cheatsheet

Q: What's the difference between ss and netstat? Which should I use?

ss (socket statistics) is the modern replacement for netstat — it's faster, more accurate, and comes from the iproute2 package which is actively maintained. netstat is from the deprecated net-tools package. Always prefer ss on modern Linux. Use ss -tuln to list listening ports and ss -tup to see established connections with process info.

Q: Ping doesn't mean a service is up, and no ping doesn't mean it's down?

Correct. ICMP (ping) may be blocked or rate-limited by firewalls while TCP services (like HTTP/80) work fine. Conversely, ping succeeding only confirms network-layer reachability, not application-layer health. Use ping for basic connectivity checks, and test actual services with nc -vz host port or curl.

Q: What are common tcpdump tips and pitfalls?

1) Permissions: packet capture usually needs root. 2) Filtering: use BPF expressions to reduce noise, e.g. 'port 80 and host 10.0.0.1'. 3) Performance: on high-traffic links, use -w to save to file for offline analysis. 4) Packet size: -s 0 captures the full packet. 5) Avoid -i any if you need promiscuous mode per interface.

Q: What's the difference between dig, nslookup, and host?

dig (Domain Information Groper) is the most powerful and detailed — it's the go-to DNS troubleshooting tool. nslookup is simpler but dated, with interactive mode support. host is the most concise, great for quick lookups. Use dig for troubleshooting, host for quick checks. All three use the system resolver library under the hood.

Network issues are among the most common problems in operations and development. This cheatsheet brings together the most practical Linux network troubleshooting commands — covering the full diagnostic chain from physical interfaces and socket connections to DNS resolution, route tracing, packet capture, performance benchmarking, and TLS security checks. Every command includes a runnable example to help you quickly pinpoint network bottlenecks and failures.

Updated: 2026-07-16·40 commands

Quick Reference

Task

Command

List interfaces and IPs	`ip addr show` or `ip a`
List listening ports	`ss -tuln`
DNS resolution	`dig example.com`
Route tracing	`traceroute example.com`
Continuous trace + latency	`mtr example.com`
Basic connectivity test	`ping -c 5 example.com`
Port connectivity test	`nc -vz host port`
Packet capture	`tcpdump -i eth0`
Bandwidth test	`iperf3 -c server_ip`
TLS handshake diagnosis	`openssl s_client -connect host:443`

Network Interfaces

``bash # List all network interfaces and their states ip link show

# Show IP addresses assigned to interfaces ip addr show # Shorthand ip a

# Bring an interface up or down ip link set eth0 up ip link set eth0 down

# Show interface statistics (packets, errors, drops) ip -s link show eth0

# Query NIC capabilities and current settings ethtool eth0

# Show driver info and firmware version ethtool -i eth0

# Check negotiated speed, duplex, and link status ethtool eth0 | grep -E 'Speed|Duplex|Link detected'

# Identify physical NIC via PCI info lspci | grep -i ethernet`

`Sockets & Connections`

`bash # List all listening TCP/UDP ports (numeric) ss -tuln

# Show established TCP connections with processes ss -tup

# Socket statistics summary (total, state breakdown) ss -s

# Filter connections by state (e.g., TIME-WAIT) ss -t state time-wait

# Show connections on a specific port ss -t sport = :22

# Legacy netstat equivalent for listening ports netstat -tuln

# Show network statistics per protocol netstat -s

# Test if a TCP port is open nc -vz example.com 443

# Test a UDP port nc -vzu example.com 53

# Create a simple TCP listener (for testing) nc -lk 9999

# TCP connect scan (full handshake) nmap -sT example.com

# SYN stealth scan (requires root) nmap -sS example.com

# Scan specific ports nmap -p 22,80,443 example.com

# Fast scan of most common ports nmap -F example.com`

`DNS Resolution`

`bash # Detailed DNS query (A record) dig example.com

# Query a specific DNS server dig @8.8.8.8 example.com

# Reverse DNS lookup (IP to domain) dig -x 8.8.8.8

# Query specific record type (MX) dig example.com MX

# Query all record types dig example.com ANY

# Short output (just the result) dig +short example.com

# Trace the DNS resolution path dig +trace example.com

# Basic DNS query (interactive available) nslookup example.com

# Query with specific DNS server nslookup example.com 8.8.8.8

# Quick lookup (concise output) host example.com

# Query a specific record type host -t AAAA example.com

# Reverse lookup host 8.8.8.8`

`Routing & Path`

`bash # Show routing table ip route show # Shorthand ip r

# Add a default gateway ip route add default via 10.0.0.1

# Add a static route ip route add 10.0.0.0/24 via 192.168.1.1

# Delete a route ip route del 10.0.0.0/24

# Check which route is used for a specific IP ip route get 8.8.8.8

# Trace the network path to a destination traceroute example.com

# Fast trace (no hostname resolution) traceroute -n example.com

# Set max hops and timeout traceroute -m 30 -w 3 example.com

# Use ICMP probes (bypass more firewalls) traceroute -I example.com

# Continuous trace + real-time latency stats mtr example.com

# Report mode (run N probes then exit) mtr -r -c 50 example.com

# Faster MTR (no hostname resolution) mtr -n example.com

# Basic ping (5 packets) ping -c 5 example.com

# Custom interval (0.2s between pings) ping -i 0.2 -c 20 example.com

# Flood ping (stress test, requires root) ping -f -c 1000 target`

`Packet Capture & Analysis`

`bash # Capture all traffic on an interface tcpdump -i eth0

# Limit number of captured packets tcpdump -i eth0 -c 100

# Capture traffic on a specific port tcpdump -i eth0 port 443

# Capture traffic to/from a specific host tcpdump -i eth0 host 10.0.0.1

# Combined conditions (and) tcpdump -i eth0 port 80 and host 10.0.0.1

# Combined conditions (or) tcpdump -i eth0 port 80 or port 443

# Save capture to file (for Wireshark analysis) tcpdump -i eth0 -w capture.pcap

# Read a saved capture file tcpdump -r capture.pcap

# Display hex and ASCII content tcpdump -i eth0 -X

# Show packet payload in ASCII tcpdump -i eth0 -A host example.com

# Don't resolve hostnames or ports (faster) tcpdump -i eth0 -nn

# Capture only ICMP traffic (e.g., ping) tcpdump -i eth0 icmp

# Capture packets larger than N bytes tcpdump -i eth0 greater 1000`

`Network Performance`

`bash # Start iperf3 in server mode iperf3 -s

# iperf3 client bandwidth test (default TCP) iperf3 -c 10.0.0.1

# iperf3 UDP test (specify bandwidth) iperf3 -c 10.0.0.1 -u -b 100m

# iperf3 reverse test (server-to-client) iperf3 -c 10.0.0.1 -R

# iperf3 bidirectional test (send and receive) iperf3 -c 10.0.0.1 --bidir

# iperf3 test duration in seconds iperf3 -c 10.0.0.1 -t 30

# iperf3 with multiple parallel streams iperf3 -c 10.0.0.1 -P 4

# Test MTU (Maximum Transmission Unit) ping -M do -s 1472 target

# Detect path MTU traceroute --mtu target`

`TLS/SSL Diagnostics`

`bash # Test TLS handshake (certificates, ciphers) openssl s_client -connect example.com:443

# Show full certificate chain openssl s_client -connect example.com:443 -showcerts

# SNI-aware TLS connection (required for multi-domain hosts) openssl s_client -connect 1.2.3.4:443 -servername example.com

# Check certificate validity dates openssl s_client -connect example.com:443 \ 2>/dev/null | openssl x509 -noout -dates

# Show certificate subject and issuer openssl s_client -connect example.com:443 \ 2>/dev/null | openssl x509 -noout -subject -issuer

# Specify TLS version openssl s_client -connect example.com:443 -tls1_2

# Test a specific cipher suite openssl s_client -connect example.com:443 \ -cipher 'ECDHE-RSA-AES128-GCM-SHA256'

# Verify certificate chain completeness openssl s_client -connect example.com:443 \ -verify_return_error -showcerts \ < /dev/null 2>/dev/null``

Interfaces(5)

Command	Level	Example
`ip link show` List all network interfaces and their states	Basic	`ip link show`
`ip addr show / ip a` Show IP addresses assigned to network interfaces	Basic	`ip addr show`
`ip link set <iface> up/down` Bring a network interface up or down	Intermediate	`ip link set eth0 up`
`ip -s link show <iface>` Show interface transmit/receive statistics (packets, errors, drops)	Intermediate	`ip -s link show eth0`
`ethtool <iface>` Query NIC driver capabilities and current settings (speed, duplex, etc.)	Intermediate	`ethtool eth0`

Sockets(9)

Command	Level	Example
`ss -tuln` List all listening TCP/UDP ports in numeric format	Basic	`ss -tuln`
`ss -tup` Show established TCP connections with associated processes	Intermediate	`ss -tup`
`ss -s` Show socket statistics summary (total connections, state breakdown)	Intermediate	`ss -s`
`netstat -tuln` Legacy tool to list listening ports (net-tools compatibility)	Basic	`netstat -tuln`
`nc -vz <host> <port>` Test if a TCP port is reachable (port scan)	Basic	`nc -vz example.com 443`
`nc -lk <port>` Create a simple TCP listener service (for testing)	Intermediate	`nc -lk 9999`
`nmap -sT <target>` TCP connect scan (full three-way handshake)	Intermediate	`nmap -sT example.com`
`nmap -sS <target>` SYN stealth scan (half-open scan, requires root)	Expert	`nmap -sS example.com`
`nmap -p <ports> <target>` Scan one or more specific ports	Intermediate	`nmap -p 22,80,443 example.com`

DNS(5)

Command	Level	Example
`dig <domain>` Detailed DNS query (default: A record lookup)	Basic	`dig example.com`
`dig @<server> <domain>` Query a specific DNS server for resolution	Intermediate	`dig @8.8.8.8 example.com`
`dig -x <ip>` Reverse DNS lookup (IP address to domain name)	Intermediate	`dig -x 8.8.8.8`
`nslookup <domain>` Basic DNS lookup tool (supports interactive mode)	Basic	`nslookup example.com`
`host <domain>` Quick DNS lookup (concise output)	Basic	`host example.com`

Routing(8)

Command	Level	Example
`ip route show` Show the system routing table	Intermediate	`ip route show`
`ip route add <prefix> via <gateway>` Add a static route or default gateway	Intermediate	`ip route add default via 10.0.0.1`
`ip route get <ip>` Check the routing path decision for an IP	Intermediate	`ip route get 8.8.8.8`
`traceroute <host>` Trace the network path to a destination host	Intermediate	`traceroute example.com`
`traceroute -n <host>` Trace path without hostname resolution (faster)	Intermediate	`traceroute -n example.com`
`mtr <host>` Continuous route trace with real-time latency statistics	Intermediate	`mtr example.com`
`ping -c <count> <host>` Send a specified number of ICMP Echo requests	Basic	`ping -c 5 example.com`
`ping -f <host>` Flood ping (high-frequency packets, requires root)	Expert	`ping -f -c 1000 target`

Packet Capture(5)

Command	Level	Example
`tcpdump -i <iface>` Capture packets on a specified network interface	Intermediate	`tcpdump -i eth0`
`tcpdump <filter>` Capture specific traffic using BPF filter expressions	Intermediate	`tcpdump -i eth0 port 443 or port 80`
`tcpdump -w <file> -r <file>` Save captured packets to file or read a saved capture	Intermediate	`tcpdump -i eth0 -w capture.pcap && tcpdump -r capture.pcap`
`tcpdump -X / -A` Display packet payload (hex + ASCII or plain ASCII)	Expert	`tcpdump -i eth0 -X host example.com`
`tcpdump -nn` Don't resolve hostnames or port names (faster, more secure)	Intermediate	`tcpdump -i eth0 -nn`

Performance(5)

Command	Level	Example
`iperf3 -s` Start iperf3 in server mode (waits for client connection)	Intermediate	`iperf3 -s`
`iperf3 -c <server>` iperf3 client bandwidth test (default TCP)	Intermediate	`iperf3 -c 10.0.0.1`
`iperf3 -u -b <bandwidth>` iperf3 UDP test (specify target bandwidth)	Intermediate	`iperf3 -c 10.0.0.1 -u -b 100m`
`iperf3 -R` iperf3 reverse test (server-to-client direction)	Intermediate	`iperf3 -c 10.0.0.1 -R`
`ping -M do -s <size> <host>` MTU discovery (prohibit fragmentation, set payload size)	Expert	`ping -M do -s 1472 target`

TLS/SSL(3)

Command	Level	Example
`openssl s_client -connect <host>:<port>` Test TLS handshake and view certificates, cipher suites, etc.	Intermediate	`openssl s_client -connect example.com:443`
`openssl s_client -showcerts` Display the full TLS certificate chain	Expert	`openssl s_client -connect example.com:443 -showcerts`
`openssl s_client -servername <host>` SNI-aware TLS connection (required for multi-domain hosts)	Expert	`openssl s_client -connect 1.2.3.4:443 -servername example.com`

FAQ

What's the difference between ss and netstat? Which should I use?

Ping doesn't mean a service is up, and no ping doesn't mean it's down?

What are common tcpdump tips and pitfalls?

What's the difference between dig, nslookup, and host?

This cheatsheet is compiled from official tool documentation. Last updated: 2026-07-16.