Network Tools You Should Know

Your toolbox

Network tools are small programs that each answer one specific question: is that host reachable, which route do packets take, what does DNS say, which ports are open. No single tool does everything, so the skill is knowing which question you are asking and picking the tool that answers it.

This lesson goes through the ones you will use most, with the exact commands. Try each of them on your own computer as you read.

ping: is the host reachable

ping example.com
ping -c 4 example.com      # Linux and macOS: stop after 4 packets
ping -n 4 example.com      # Windows: stop after 4 packets

ping sends a small message and waits for the reply. It tells you whether a host is reachable and how long a round trip takes. On Linux and macOS it keeps going until you press Ctrl+C, unless you set a count.

traceroute: which route is used

traceroute example.com     # Linux and macOS
tracert example.com        # Windows

It lists each router that your packets pass on the way to the destination. If the list stops part of the way, you have found where the trouble starts.

Reading traceroute output

 1  192.168.1.1      1.2 ms     your router
 2  10.20.0.1        8.4 ms     your provider
 3  72.14.215.85    14.9 ms     a backbone router
 4  * * *                       a router that did not reply
 5  93.184.216.34   21.0 ms     the destination

Each line is one hop, with the time it took. Times normally rise as you get further away, and a sudden jump to a very high value shows where the slow part is. A line of stars means that router did not answer, which is common and not always a problem.

If the trace stops for good and never reaches the end, the problem is at or just after the last hop that replied.

nslookup and dig: what does DNS say

nslookup example.com
dig example.com
dig example.com MX
dig @8.8.8.8 example.com

dig @8.8.8.8 asks one specific DNS server for the answer. It is the quickest way to find out whether your own resolver is the problem.

ss and netstat: what is listening

ss -tuln            # Linux: TCP and UDP, listening, numeric
netstat -an         # Windows and older Linux

They show open ports and active connections on your machine. They are useful for spotting a service you did not expect to be running.

ip and ifconfig: how is my network set up

ip addr             # your addresses
ip route            # your routes and default gateway
ip neigh            # the ARP cache

ifconfig is the older tool for similar information on Linux and macOS, and ipconfig is the Windows equivalent.

curl and wget: can I fetch this

curl -I https://example.com        # response headers only
curl https://example.com           # the page body
wget https://example.com/file.zip  # download a file

curl is the standard way to test a web service at the HTTP level. The status code in the first line of its output tells you whether the server answered and how.

nmap: what is on this network

nmap 192.168.1.0/24            # find devices on your home network
nmap -p 22,80,443 192.168.1.1  # check specific ports

Nmap discovers devices and open ports. Only scan networks that you own or have written permission to test. Scanning other people's networks can be illegal, and it is treated as hostile activity.

Quick port checks

Sometimes you only want to know whether one port is open on a server. Besides nmap, the small tool nc (netcat) can check it:

nc -zv example.com 443

The result tells you a lot:

• Connection succeeded: something is listening and nothing blocked you.
• Connection refused: the computer answered, but nothing listens on that port.
• A long wait with no answer: a firewall is probably dropping the traffic silently.

Wireshark: show me the actual packets

Wireshark is a graphical program that captures network traffic and lets you open every packet. It is one of the best ways to learn how networks really behave, because you see DNS lookups, TCP handshakes and HTTP requests exactly as they happen.

Which tool for which question

• Is it up? ping
• Where does the path break? traceroute
• Is DNS answering correctly? dig
• What is listening on my machine? ss
• Does the web server answer? curl
• What devices and ports are around? nmap
• What is actually on the wire? Wireshark

Putting the tools together

Suppose https://shop.example.com will not open. You can narrow it down in five steps:

1. ip addr and ip route: do I have an address and a gateway?
2. ping 8.8.8.8: can I reach the internet?
3. dig shop.example.com: does the name resolve to an address?
4. traceroute shop.example.com: where does the path stop?
5. curl -I https://shop.example.com: does the web server answer, and with which status code?

Each result removes one possibility. By the end you know which layer to look at.