A sysadmin's guide to network management

A reference list of Linux utilities and commands makes managing servers and networks easier.
357 readers like this.
open network


If you're a sysadmin, your daily tasks include managing servers and the data center's network. The following Linux utilities and commands—from basic to advanced—will help make network management easier.

In several of these commands, you'll see <fqdn>, which stands for "fully qualified domain name." When you see this, substitute your website URL or your server (e.g., server-name.company.com), as the case may be.


As the name suggests, ping is used to check the end-to-end connectivity from your system to the one you are trying to connect to. It uses ICMP echo packets that travel back to your system when a ping is successful. It's also a good first step to check system/network connectivity. You can use the ping command with IPv4 and IPv6 addresses. (Read my article "How to find your IP address in Linux" to learn more about IP addresses.)


  • IPv4: ping <ip address>/<fqdn>
  • IPv6: ping6 <ip address>/<fqdn>

You can also use ping to resolve names of websites to their corresponding IP address, as shown below:



This is a nice utility for tracing the full network path from your system to another. Where ping checks end-to-end connectivity, the traceroute utility tells you all the router IPs on the path you travel to reach the end system, website, or server. traceroute is usually is the second step after ping for network connection debugging.


  • traceroute <ip address>/<fqdn>



  • telnet <ip address>/<fqdn> is used to telnet into any server.


The network statistics (netstat) utility is used to troubleshoot network-connection problems and to check interface/port statistics, routing tables, protocol stats, etc. It's any sysadmin's must-have tool.


  • netstat -l shows the list of all the ports that are in listening mode.
  • netstat -a shows all ports; to specify only TCP, use -at (for UDP use -au).
  • netstat -r provides a routing table.

  • netstat -s provides a summary of statistics for each protocol.

netstat-s command
  • netstat -i displays transmission/receive (TX/RX) packet statistics for each interface.

netstat-i command


nmcli is a good utility for managing network connections, configurations, etc. It can be used to control Network Manager and modify any device's network configuration details.


  • nmcli device lists all devices on the system.

  • nmcli device show <interface> shows network-related details of the specified interface.

  • nmcli connection checks a device's connection.

  • nmcli connection down <interface> shuts down the specified interface.

  • nmcli connection up <interface> starts the specified interface.

  • nmcli con add type vlan con-name <connection-name> dev <interface> id <vlan-number> ipv4 <ip/cidr> gw4 <gateway-ip> adds a virtual LAN (VLAN) interface with the specified VLAN number, IP address, and gateway to a particular interface.



There are many commands you can use to check and configure routing. Here are some useful ones:


  • ip route shows all the current routes configured for the respective interfaces.

IP route
  • route add default gw <gateway-ip> adds a default gateway to the routing table.
  • route add -net <network ip/cidr> gw <gateway ip> <interface> adds a new network route to the routing table. There are many other routing parameters, such as adding a default route, default gateway, etc.
  • route del -net <network ip/cidr> deletes a particular route entry from the routing table.

adds or deletes a new network route to the routing table
  • ip neighbor shows the current neighbor table and can be used to add, change, or delete new neighbors.

ip neighbor

ip neighbor help
  • arp (which stands for address resolution protocol) is similar to ip neighbor. arp maps a system's IP address to its corresponding MAC (media access control) address.


Tcpdump and Wireshark

Linux provides many packet-capturing tools like tcpdump, wireshark, tshark, etc. They are used to capture network traffic in packets that are transmitted/received and hence are very useful for a sysadmin to debug any packet losses or related issues. For command-line enthusiasts, tcpdump is a great tool, and for GUI users, wireshark is a great utility to capture and analyze packets. tcpdump is a built-in Linux utility to capture network traffic. It can be used to capture/show traffic on specific ports, protocols, etc.


  • tcpdump -i <interface-name> shows live packets from the specified interface. Packets can be saved in a file by adding the -w flag and the name of the output file to the command, for example: tcpdump -w <output-file.> -i <interface-name>.

tcpdump -i
  • tcpdump -i <interface> src <source-ip> captures packets from a particular source IP.
  • tcpdump -i <interface> dst <destination-ip> captures packets from a particular destination IP.
  • tcpdump -i <interface> port <port-number> captures traffic for a specific port number like 53, 80, 8080, etc.
  • tcpdump -i <interface> <protocol> captures traffic for a particular protocol, like TCP, UDP, etc.


iptables is a firewall-like packet-filtering utility that can allow or block certain traffic. The scope of this utility is very wide; here are some of its most common uses.


  • iptables -L lists all existing iptables rules.
  • iptables -F deletes all existing rules.

The following commands allow traffic from the specified port number to the specified interface:

  • iptables -A INPUT -i <interface> -p tcp –dport <port-number> -m state –state NEW,ESTABLISHED -j ACCEPT
  • iptables -A OUTPUT -o <interface> -p tcp -sport <port-number> -m state – state ESTABLISHED -j ACCEPT

The following commands allow loopback access to the system:

  • iptables -A INPUT -i lo -j ACCEPT
  • iptables -A OUTPUT -o lo -j ACCEPT


The nslookup tool is used to obtain IP address mapping of a website or domain. It can also be used to obtain information on your DNS server, such as all DNS records on a website (see the example below). A similar tool to nslookup is the dig (Domain Information Groper) utility.


  • nslookup <website-name.com> shows the IP address of your DNS server in the Server field, and, below that, gives the IP address of the website you are trying to reach.
  • nslookup -type=any <website-name.com> shows all the available records for the specified website/domain.

Network/interface debugging

Here is a summary of the necessary commands and files used to troubleshoot interface connectivity or related network issues.


  • ss is a utility for dumping socket statistics.
  • nmap <ip-address>, which stands for Network Mapper, scans network ports, discovers hosts, detects MAC addresses, and much more.
  • ip addr/ifconfig -a provides IP addresses and related info on all the interfaces of a system.
  • ssh -vvv user@<ip/domain> enables you to SSH to another server with the specified IP/domain and username. The -vvv flag provides "triple-verbose" details of the processes going on while SSH'ing to the server.
  • ethtool -S <interface> checks the statistics for a particular interface.
  • ifup <interface> starts up the specified interface.
  • ifdown <interface> shuts down the specified interface.
  • systemctl restart network restarts a network service for the system.
  • /etc/sysconfig/network-scripts/<interface-name> is an interface configuration file used to set IP, network, gateway, etc. for the specified interface. DHCP mode can be set here.
  • /etc/hosts this file contains custom host/domain to IP mappings.
  • /etc/resolv.conf specifies the DNS nameserver IP of the system.
  • /etc/ntp.conf specifies the NTP server domain.


Nice article, but you should consider using "ss" instead of "netstat" that's going to be deprecated.

To the ping/traceroute tools, don't forget mtr it's really handy.

For convenience also host and dig are really helpful alongside nslookup.

Not sure why so many people are still obsessed with iptables when nftables is just round the corner and available in any reasonably up to date distribution.

Hello, I'm trying to access the URL of the article "Advanced Linux commands cheat sheet" in "More Linux resources" but a error code 404 is returned. Might someone solve this problem?

Using or encouraging the use of nslookup is a good way to tell others that you're really a Windows admin who just dabbles in Linux administration. That tool has been deprecated for about 10 years now in favor of dig.

AFAIK nslookup was reinstated as not deprecated, dig is a very powerful tool, although both have their pros and cons

In reply to by foobrew (not verified)

telnet server should be disabled by default these days on all *nix boxes. ssh is a far better choice. You can actually do a lot more with it than you can with telnet, anyhow.

That said, though, there is one thing that a telnet client can be useful for that ssh can't do. It's handy for passing handcrafted commands to other services to see how they respond. However, the number of debugging options is so broad these days that hardly anybody bothers to use telnet for this purpose.

rsync is also really handy for grabbing all kinds of files for offline analysis. It should be in every sysadmin's troubleshooting toolkit.

Speaking of which, diff is really handy for comparing config files against baseline files to look for changes.

I would say wireshark and tshark.

Creative Commons LicenseThis work is licensed under a Creative Commons Attribution-Share Alike 4.0 International License.