10 Essential Linux Commands for Network Troubleshooting (Examples & Usage)

1. ping

Ping uses the ICMP protocol to test host reachability and measure latency.

[root@VM-0-5-centos ~]# ping www.21cto.com
PING www.21cto.com (81.70.105.8) 56(84) bytes of data.
64 bytes from 81.70.105.8 (81.70.105.8): icmp_seq=1 ttl=63 time=0.228 ms
64 bytes from 81.70.105.8 (81.70.105.8): icmp_seq=2 ttl=63 time=0.285 ms
... (additional lines omitted for brevity) ...
--- www.21cto.com ping statistics ---
13 packets transmitted, 13 received, 0% packet loss, time 12018ms
rtt min/avg/max/mdev = 0.200/0.233/0.285/0.027 ms

2. traceroute

Traceroute shows the route packets take to reach a destination. Install it if missing:

# For Debian based distributions like Ubuntu
sudo apt-get install traceroute

# For RPM based distributions like CentOS
sudo yum install traceroute

Example output:

[root@VM-0-5-centos ~]# traceroute baidu.com
traceroute to baidu.com (39.156.66.10), 30 hops max, 60 byte packets
 1  * * *
 2  11.66.248.84 (11.66.248.84)  0.293 ms * *
 3  * * *
 4  10.200.46.253 (10.200.46.253)  0.631 ms 10.200.46.93 (10.200.46.93)  1.152 ms 10.196.89.113 (10.196.89.113)  0.628 ms
 ... (additional hops omitted) ...

3. netstat

Netstat displays network connections, routing tables, interface statistics, and more, useful for diagnosing connectivity problems.

[root@VM-0-5-centos ~]# netstat -tulpn
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:6379          0.0.0.0:*               LISTEN      870/redis-server
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      1188/nginx: master
... (additional lines omitted) ...

4. ifconfig / ip

These commands show and configure network interface parameters such as IP address, netmask, and MAC address.

[root@VM-0-5-centos ~]# ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.21.0.5  netmask 255.255.240.0  broadcast 172.21.15.255
        inet6 fe80::5054:ff:feca:cdf8  prefixlen 64  scopeid 0x20<link>
        ether 52:54:00:ca:cd:f8  txqueuelen 1000  (Ethernet)
        RX packets 80835008  bytes 32467819740 (30.2 GiB)
        TX packets 96298531  bytes 91472563700 (85.1 GiB)

5. tcpdump

Tcpdump captures and displays network traffic in real time, aiding packet analysis and anomaly detection.

yum install tcpdump

[root@VM-0-5-centos ~]# tcpdump -i eth0 tcp port 80
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
12:03:17.585041 IP VM-0-5-centos.39012 > 169.254.0.4.http: Flags [S], seq 1262259857, win 32120, ...
... (additional lines omitted) ...
108 packets captured
108 packets received by filter
0 packets dropped by kernel

6. nslookup / dig

Both tools query DNS servers for domain name resolution and help diagnose DNS issues.

yum install bind-utils

[root@VM-0-5-centos ~]# nslookup google.com
Server:         183.60.83.19
Address:        183.60.83.19#53

Non-authoritative answer:
Name:   google.com
Address: 142.251.43.14

[root@VM-0-5-centos ~]# dig google.com
; <<>> DiG 9.16.23-RH <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49289
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;google.com.                    IN      A
;; ANSWER SECTION:
google.com.             7       IN      A       93.46.8.90
;; Query time: 5 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Sat May 04 12:10:21 CST 2024
;; MSG SIZE  rcvd: 44

7. iptables / firewalld

These firewall utilities configure packet filtering and NAT rules to protect the system.

[root@VM-0-5-centos ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
...
Chain OUTPUT (policy ACCEPT)
...

8. ss

ss displays socket statistics, showing listening and established connections for TCP, UDP, and UNIX domain sockets.

[root@VM-0-5-centos ~]# ss -tuplpn
Netid    State      Recv-Q Send-Q Local Address:Port   Peer Address:Port   Process
udp      UNCONN     0      0    0.0.0.0:111          0.0.0.0:*          users:("rpcbind",pid=653,fd=5)
... (additional lines omitted) ...

9. arp

arp shows and modifies the kernel's IP‑to‑MAC address mapping table.

[root@VM-0-5-centos ~]# arp -a
_gateway (172.21.0.1) at fe:ee:0b:ca:e5:69 [ether] on eth0

10. mtr

mtr combines ping and traceroute, providing continuous network path diagnostics.

yum install mtr

My traceroute  [v0.94]
VM-0-5-centos (::1) -> localhost
Keys:  Help   Display mode   Restart statistics   Order of fields   quit
Host                                 Loss% Snt Last Avg Best Wrst StDev
1. VM-0-5-centos                     0.0%  14 0.1 0.1 0.1 0.1 0.0

Mastering these commands equips Linux administrators with essential tools for diagnosing and resolving network problems.