Skip to main content

7 Linux networking commands that every sysadmin should know

There are a few commands that should always be in your sysadmin toolbox. Get to know these 7 essential networking commands.
7 Linux networking commands that you need to know
Image by Hebi B. from Pixabay

This article is the first in a series centered around 'crowd sourced' command recommendations. I asked a group of our core contributors what their favorite Linux commands were, and the feedback was overwhelming. We received 46 individual commands, and many of them were underscored by multiple submissions.

This series represents the complete list, broken down by category. I have dubbed these first seven commands "Networking commands that everyone should know."

Editors Note: Evans Amoany provided the command information and examples. One of our Sudoers and a talented *nix admin. Shoutout to Evans for doing the heavy lifting here.

[ You might also enjoy: Linux networking: 13 uses for netstat ]


The ip command is one of the basic commands every administrator will need in daily work, from setting up new systems and assigning IPs to troubleshooting existing systems. The ip command can show address information, manipulate routing, plus display network various devices, interfaces, and tunnels.

The syntax is as follows:


The OBJECT is the most important part of the synopsis, and the following are supported (some omitted for brevity):

address - protocol (IPv4 or IPv6) address on a device.

  • tunnel - tunnel over IP
  • route - routing table entry
  • rule - rule in routing policy database
  • vrf - manage virtual routing and forwarding devices
  • xfrm - manage IPSec policies

Here are some common use cases for the ip command.

To show the IP addresses assigned to an interface on your server:

[root@server ~]# ip address show 

To assign an IP to an interface, for example, enps03:

[root@server ~]# ip address add dev enps03

To delete an IP on an interface:

[root@server ~]# ip address del dev enps03

Alter the status of the interface by bringing the interface eth0 online:

[root@server ~]# ip link set eth0 up

Alter the status of the interface by bringing the interface eth0 offline:

[root@server ~]# ip link set eth0 down

Alter the status of the interface by changing the MTU of eth0:

[root@server ~]# ip link set eth0 mtu 9000

Alter the status of the interface by enabling promiscuous mode for eth0:

[root@server ~]# ip link set eth0 promisc on

Add a default route (for all addresses) via the local gateway that can be reached on device eth0:

[root@server ~]# ip route add default via dev eth0

Add a route to via the gateway at

[root@server ~]# ip route add via

Add a route to that can be reached on device eth0:

[root@server ~]# ip route add dev eth0

Delete the route for via the gateway at

[root@server ~]# ip route delete via

Display the route taken for IP

[root@server ~]# ip route get


The ifconfig command was/is a staple in many sysadmin's tool belt for configuring and troubleshooting networks. It has since been replaced by the ip command discussed above. However, if you would like more information on it, check out our previously published article here.


MTR (Matt's traceroute) is a program with a command-line interface that serves as a network diagnostic and troubleshooting tool. This command combines the functionality of the ping and traceroute commands. Just like a traceroute, the mtr command will show the route from a computer to a specified host. mtr provides a lot of statistics about each hop, such as response time and percentage. With the mtr command, you will get more information about the route and be able to see problematic devices along the way. If you see a sudden increase in response time or packet loss, then obviously, there is a bad link somewhere.

The syntax of the command is as follows:

mtr <options> hostname/IP

Let's look at some common use cases.

The basic mtr command shows you the statistics, including each hop (hostnames) with time and loss%:

[root@server ~]# mtr

Show numeric IP addresses (if you use -g, you will get IP addresses (numbers) instead of hostnames):

[root@server ~]# mtr -g

Show the numeric IP addresses and hostnames, too:

[root@server ~]# mtr -b

Set the number of pings that you want to send:

[root@server ~]# mtr -c 10

Get a report of the mtr command result:

[root@server ~]# mtr -r -c 10 > mtr-command-google-output


[root@server ~]# mtr -rw -c 10 > mtr-command-google-output

Force the use of the TCP instead of the ICMP:

[root@server ~]# mtr –tcp

Force the use of the UDP instead of the ICMP:

[root@server ~]# mtr –udp

Set the maximum amount of hops:

[root@server ~]# mtr -m 35

Define the packet size:

[root@server ~]# mtr -r -s 50

Print to CSV output:

[root@server ~]# mtr –csv

Print to XML output:

[root@server ~]# mtr –xml



The tcpdump command is designed for capturing and displaying packets.

You can install tcpdump with the command below:

[root@server ~]# dnf install -y tcpdump

Before starting any capture, you need to know which interfaces tcpdump can use. You will need to use sudo or have root access in this case.

[root@server ~]# tcpdump -D

  1 eth0
  2 nflog
  3 nfqueue
  4 usbmon1
  5 any
  6 lo (Loopback)

If you want to capture traffic on eth0, you can initiate that with tcpdump -i eth0 sample output:

[root@server ~]# tcpdump -i eth0
[root@server ~]# tcpdump -i eth0 -c 10

Capture traffic to and from one host

You can filter out traffic coming from a specific host. For example, to find traffic coming from and going to, use the command:

[root@server ~]# tcpdump -i eth0 -c 10 host

For traffic coming from, use:

[root@server ~]# tcpdump -i eth0 src host

For outbound traffic going to, use:

[root@server ~]# tcpdump -i eth0 dst host

Capture traffic to and from a network

You can also capture traffic to and from a specific network using the command below:

[root@server ~]# tcpdump -i eth0 net mask


[root@server ~]# tcpdump -i eth0 net

You can also filter based on either source or destination.

Based on the source (traffic coming from):

[root@server ~]# tcpdump -i eth0 src net

Based on the destination (traffic going to):

[root@server ~]# tcpdump -i eth0 dst net

Capture traffic to and from port numbers

Capture only DNS port 53 traffic:

[root@server ~]# tcpdump -i eth0 port 53

For a specific host,

[root@server ~]# tcpdump -i eth0 host and port 53

To capture only HTTPS traffic,

[root@server ~]# tcpdump -i eth0 -c 10 host and port 443

To capture all port except port 80 and 25,

[root@server ~]# tcpdump -i eth0 port not 53 and not 25


The netstat tool for printing network connections, routing tables, interface statistics, masquerade connections, and multicast memberships. This utility is part of the net-tool package, as is ifconfig. In the new iproute2 package, the ss tool is used to achieve the same objectives.

If netstat is not found on your system, install it with this command:

[root@server ~]# dnf install net-tools

The primary usage of netstat is without any parameters:

[root@server ~]# netstat

For advanced usage, expand the netstat command with options:

netstat <options>

Or list the options one by one:

netstat <option 1> <option 2> <option 3>

To list all ports and connections regardless of their state or protocol, use:

[root@server ~]# netstat -a

List all TCP ports by running:

[root@server ~]# netstat -at

List all UDP ports with:

[root@server ~]# netstat -au

To return a list of only listening ports for all protocols, use:

[root@server ~]# netstat -l

List all listening TCP ports with:

[root@server ~]# netstat -lt

Return only listening UDP ports by running:

[root@server ~]# netstat -lu

To list UNIX listening ports, use:

[root@server ~]# netstat -lx

Display statistics for all ports regardless of the protocol with:

[root@server ~]# netstat -s

List statistics for TCP ports only with:

[root@server ~]# netstat -st

To view the TCP connections with the PID/Program name listed, use:

[root@server ~]# netstat -tp

To find a process that is using a particular port number, run:

[root@server ~]# netstat -an | grep ‘:<port number>’


Use the nslookup utility to query Internet name servers interactively. Use it to perform DNS queries and receive domain names or IP addresses, or any other specific DNS records.

Consider the following common examples.

To find the A record of а domain:

[root@server ~]# nslookup

To check the NS records of a domain:

[root@server ~]# nslookup -type=ns

To find the MX records responsible for the email exchange:

[root@server ~]# nslookup -query=mx

To find all of the available DNS records of a domain:

[root@server ~]# nslookup -type=any

To check the use of a specific DNS server (in this case, query using the specific nameserver

[root@server ~]# nslookup

Checking DNS A records to see the IPs of a domain is a common practice, but sometimes you need to verify if an IP address is related to a specific domain. For that purpose, you need a reverse DNS lookup. 

[root@server ~]# nslookup


Ping is a tool that verifies IP-level connectivity to another TCP/IP computer by sending Internet Control Message Protocol (ICMP) Echo Request messages. The receipt of corresponding Echo Reply messages is displayed, along with round-trip times. Ping is the primary TCP/IP command used to troubleshoot connectivity, reachability, and name resolution.

Simple ping commands take only one parameter: The hostname or the host IP address that you want to verify. A simple ping example is just like below:

[root@server ~]# ping
PING ( 56(84) bytes of data.
64 bytes from ( icmp_seq=1 ttl=56 time=10.7 ms
64 bytes from ( icmp_seq=2 ttl=56 time=10.2 ms
64 bytes from ( icmp_seq=3 ttl=56 time=10.4 ms
64 bytes from ( icmp_seq=4 ttl=56 time=10.4 ms
64 bytes from ( icmp_seq=5 ttl=56 time=17.3 ms
--- ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4005ms
rtt min/avg/max/mdev = 10.219/11.844/17.381/2.773 ms

You need to stop the ping command by pressing CTRL+C. Otherwise, it will ping until you stop it. After every ping command, it will display a summary report with the following information:

  • Min: Minimum time that it takes to get a response from the host that has been pinged from your end.
  • Avg: Average time that it takes to get a response from the host that has been pinged from your end.
  • Max: Maximum time that it takes to get a response from the host that has been pinged from your end.

Also, you will see TTL, which stands for Time To Live. Ping uses a numerical TTL value to attempt to reach a given host computer via the route path. This is also known as the hop limit.

Normally, when you run a simple ping command without passing any additional parameters, Linux will ping that host for an infinite amount of time. If you want to ping a host ten times, use the following command:

[root@server ~]# ping -c 10

Use option -q to view only the ping statistics summary:

[root@server ~]# ping -c 10

On systems with multiple interfaces, you can specify the interface for the ping command to use. If the system has both eth0 and eth1 and I want to ping using the eth0:

[root@server ~]# ping -I eth0

Or use the address on the interface, assuming the interface as as the IP:

[root@server ~]# ping -I

You can also ping and specify the IP version as either v4 or v6:

[root@server ~]# ping -4
[root@server ~]# ping -6

While pinging a host, you'll find different output from the ping results, including the following three examples.

Destination Host Unreachable

The possible best reason is there is no route from the local host system and to the destination desired destination host, or a remote router reports that it has no route to the destination host.

Request timed out

This result means that no Echo Reply messages were received within the default time of one second or the time that you set while you are pinging that host. This can be due to many different causes; the most common include network congestion, failure of the ARP request, packet filtering/firewall, etc.

Unknown host/Ping Request Could Not Find Host

Maybe you misspelled the hostname or the host does not exist at all in the network.

You must have 0% packet loss for every ping result with a good latency or lower response time. Depending on which transmission medium (UTP, fiber optics cable, Wi-Fi) you're using, your latency will differ.

[ Free cheat sheet: Get a list of Linux utilities and commands for managing servers and networks. ] 

Looking forward

You should add these commands and examples into your routines as you configure and troubleshoot your own networks. If you found this type of article helpful, be sure to reach out and let us know. Also, keep an eye out for part two of our community commands list. The next one is 16 general Linux commands that you can't do without.


Check out these related articles on Enable Sysadmin

Author’s photo

Evans Amoany

I work as Unix/Linux Administrator with a passion for high availability systems and clusters. I am a student of performance and optimization of systems and DevOps. I have passion for anything IT related and most importantly automation, high availability, and security. More about me

Author’s photo

Tyler Carrigan

Tyler is a community manager at Enable Sysadmin, a submarine veteran, and an all-round tech enthusiast! He was first introduced to Red Hat in 2012 by way of a Red Hat Enterprise Linux-based combat system inside the USS Georgia Missile Control Center. More about me

On Demand: Red Hat Summit 2021 Virtual Experience

Relive our April event with demos, keynotes, and technical sessions from
experts, and sign up to attend breakout sessions June 15–16.

Related Content