Linux Networking Tools

ip, ss, curl, dig, tcpdump, nmap, traceroute, and nc — the production debugging toolkit.

Overview

Linux networking diagnosis uses a layered approach matching the OSI model — start at the physical/IP layer and work up to the application layer.

Layer 3 (IP): - ip addr — interface addresses - ip route — routing table - ping — ICMP reachability - traceroute / tracepath — path discovery

Layer 4 (TCP/UDP): - ss — socket statistics, modern replacement for netstat - nc / ncat — raw TCP/UDP connections - tcpdump — packet capture

Layer 7 (Application): - curl — HTTP/HTTPS - dig / nslookup — DNS - openssl s_client — TLS handshake inspection

ss -tulpn shows all listening TCP/UDP ports with process names. Modern replacement for netstat -tulpn.

tcpdump captures packets at the kernel level:

-n disables name resolution. -w capture.pcap writes to a file for Wireshark analysis.

ss -tulpn: List all listening sockets: TCP, UDP, listening only, with process name, no name resolution. Modern replacement for netstat -tulpn.
ip route: Show the kernel routing table. ip route get 8.8.8.8 shows which interface and gateway will be used for a specific IP.
tcpdump: Kernel-level packet capture. tcpdump -i any -n port 80 captures HTTP on all interfaces.
dig +trace: Perform a full DNS resolution from root servers, showing each delegation step.
curl -v: Shows full request/response headers including TLS handshake details. curl --resolve overrides DNS for testing specific backends.

Diagnosing "connection refused" vs "connection timed out" — one means the port is closed, the other means a firewall is dropping packets
Verifying a service is listening on the expected port with ss -tulpn
Tracing DNS resolution failures with dig +trace
Inspecting TLS certificate chains with openssl s_client

A service cannot connect to a remote endpoint. Walk through your network diagnosis steps.
How do you capture and analyse packets for an HTTPS connection?