Updated: 12 October 2026 · Applies to: Ubuntu 26.04 LTS (iproute2 6.19), Debian 13 and AlmaLinux 10.2 (iproute 6.17); package names also apply to Rocky Linux and RHEL
The Linux network commands you need on a current server are ip (addresses, interfaces and routes), ss (open ports and connections), ping, tracepath, traceroute and mtr (reachability and the path), dig and host (DNS), nc and curl (test a port or a website), nmcli (NetworkManager settings) and tcpdump (watch packets). The old net-tools commands ifconfig, netstat, route and arp are deprecated; their replacements are listed further down.
Quick reference
- Show IP addresses:
ip -br addrorip addr show eth0 - Show the default gateway and routes:
ip route - Which route a destination uses:
ip route get 1.1.1.1 - Neighbours (ARP table):
ip neigh - Traffic and error counters:
ip -s link show eth0 - Listening ports and their programs:
sudo ss -tulpn - All connections:
ss -tunap; summary:ss -s - Is a host reachable:
ping -c 4 example.com - Where packets get lost:
mtr -rwn -c 5 example.com,traceroute -n example.comortracepath -n example.com - DNS lookups:
dig +short example.com,host example.com,nslookup example.com - Is a remote port open:
nc -zv example.com 443 - Does a website answer:
curl -I https://example.com - NetworkManager devices and profiles:
nmcli device status,nmcli connection show - Capture packets:
sudo tcpdump -i eth0 -n port 443
1. IP addresses and interfaces: ip
ip -br addr ip addr show eth0 hostname -I
Lab output from our Ubuntu 26.04 test container (its private address; a server shows its public IP here):
lo UNKNOWN 127.0.0.1/8 ::1/128 eth0@if1204 UP 10.88.4.39/16 fe80::7496:aeff:febd:84ba/64
-br (brief) gives one line per interface with its state and addresses. ip -4 addr shows IPv4 only, and ip -s link show eth0 adds byte, packet, error and drop counters. To find your public IP from behind NAT, see find your IP address in Linux.
2. Gateway and routes: ip route
$ ip route
default via 10.88.0.1 dev eth0 proto static metric 100
10.88.0.0/16 dev eth0 proto kernel scope link src 10.88.4.39
$ ip route get 1.1.1.1
1.1.1.1 via 10.88.0.1 dev eth0 src 10.88.4.39 uid 0
cache
The default via line is your gateway. ip route get tells you which interface, gateway and source address the server would use for one destination, which is the quickest check on a server with several IPs. ip neigh replaces arp -n and shows the MAC addresses the server has learned. More examples are in the ip command cheat sheet.
3. Open ports and connections: ss
$ sudo ss -tulpn
Netid State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
tcp LISTEN 0 5 127.0.0.1:8080 0.0.0.0:* users:(("python3",pid=3068,fd=3))
-t TCP, -u UDP, -l listening only, -p the program (needs sudo for other users' processes), -n port numbers instead of names. A service bound to 127.0.0.1, as in this lab output, only accepts connections from the server itself; 0.0.0.0 or [::] means all addresses. Filter by port with ss -tlnp 'sport = :8080', list current connections with ss -tunap and get totals with ss -s. If you are used to netstat, see netstat: command not found.
4. Reachability: ping
$ ping -c 4 example.com PING example.com (172.66.147.243) 56(84) bytes of data. 64 bytes from 172.66.147.243: icmp_seq=1 ttl=56 time=11.2 ms 64 bytes from 172.66.147.243: icmp_seq=2 ttl=56 time=11.4 ms 64 bytes from 172.66.147.243: icmp_seq=3 ttl=56 time=11.7 ms 64 bytes from 172.66.147.243: icmp_seq=4 ttl=56 time=11.2 ms --- example.com ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3003ms rtt min/avg/max/mdev = 11.151/11.370/11.728/0.229 ms
The times are a lab example from our test server, not a measure of any Ucartz network. Without -c, ping runs until you press Ctrl+C. 100% packet loss means no reply came back (the host is down, or it or a firewall drops ICMP), and ping: nonexistent.invalid: Name or service not known means the name did not resolve, so check DNS instead. More options are in Linux ping command examples.
5. The path to a host: mtr, traceroute and tracepath
$ mtr -rwn -c 5 -m 6 example.com HOST: vps Loss% Snt Last Avg Best Wrst StDev 1.|-- 10.88.0.1 0.0% 5 0.1 0.1 0.0 0.1 0.0 2.|-- 198.51.100.1 0.0% 5 0.5 0.7 0.5 0.8 0.1 3.|-- 198.51.100.9 0.0% 5 0.5 0.5 0.3 0.7 0.1 4.|-- 198.51.100.14 0.0% 5 1.2 1.5 1.0 2.3 0.5 5.|-- 203.0.113.138 0.0% 5 1.2 1.3 1.1 2.0 0.4 6.|-- 203.0.113.206 0.0% 5 10.9 30.7 10.6 85.7 32.1
Lab output; the hostname and the router addresses are replaced with documentation addresses. -r prints a report, -w wide hostnames, -n no DNS lookups, -c 5 five rounds and -m 6 stops after six hops. traceroute -n example.com and tracepath -n example.com show the same path once; sudo traceroute -T -p 443 example.com uses TCP to port 443, which helps when a firewall drops the default probes. How to read the columns: read an mtr report.
6. DNS: dig, host and nslookup
$ dig +short example.com 104.20.23.154 172.66.147.243 $ dig +short -x 1.1.1.1 one.one.one.one. $ host example.com example.com has address 104.20.23.154 example.com has address 172.66.147.243 example.com has IPv6 address 2606:4700:10::6814:179a example.com has IPv6 address 2606:4700:10::ac42:93f3 example.com mail is handled by 0 .
Lab output, the host part shortened. dig @1.1.1.1 example.com A +short asks one resolver directly, which shows whether a problem is your server's resolver (/etc/resolv.conf) or the domain's DNS. dig example.com MX +short shows mail servers and -x does a reverse lookup. Details: DNS lookup commands.
7. Test a port or a website: nc and curl
$ nc -zv example.com 443 Connection to example.com (104.20.23.154) 443 port [tcp/*] succeeded! $ nc -zv -w 3 127.0.0.1 22 nc: connect to 127.0.0.1 port 22 (tcp) failed: Connection refused $ curl -sI https://example.com | head -1 HTTP/2 200
Connection refused means the host answered but nothing listens on that port (or a firewall rejects it); a timeout usually means a firewall drops the packets. curl -I fetches only the response headers, so you see the status code and redirects.
8. Network settings: nmcli
On AlmaLinux, Rocky Linux and RHEL, NetworkManager owns the network configuration. Use nmcli device status for the devices, nmcli connection show for the saved profiles (--active for the ones in use) and nmcli device show eth0 for the addresses, gateway and DNS of one device. Ubuntu configures the network with Netplan (part of ubuntu-minimal), and Debian with ifupdown and /etc/network/interfaces. Changes you make with ip addr add or ip route add are lost at reboot: make permanent changes as shown in set a static IP address from the command line.
9. Watch the packets: tcpdump
$ sudo tcpdump -i lo -n -c 4 icmp listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes 16:01:59.022659 IP 127.0.0.1 > 127.0.0.1: ICMP echo request, id 29, seq 1, length 64 16:01:59.022673 IP 127.0.0.1 > 127.0.0.1: ICMP echo reply, id 29, seq 1, length 64 16:02:00.092690 IP 127.0.0.1 > 127.0.0.1: ICMP echo request, id 29, seq 2, length 64 16:02:00.092700 IP 127.0.0.1 > 127.0.0.1: ICMP echo reply, id 29, seq 2, length 64 4 packets captured
Lab capture on the loopback interface while pinging 127.0.0.1 (shortened). On a server, sudo tcpdump -i eth0 -n port 443 shows whether requests arrive at all, which separates a firewall problem from an application problem. Always add a filter (port, host, icmp) and -c so the capture stops.
Old net-tools commands and their replacements
ifconfig:ip addrandip linkroute -nandnetstat -rn:ip routearp -n:ip neighnetstat -tulpn:ss -tulpnnetstat -i:ip -s linknetstat -s:nstat -a, orss -sfor a summarynetstat -g:ip maddriptunnel:ip tunnel;nameif:ip link set eth0 name lan0iwconfig(wireless):iw
On Debian 13 and Ubuntu 26.04, iproute2 has priority "important" and net-tools "optional", and no Ubuntu standard or server metapackage pulls net-tools in. On AlmaLinux 10.2, net-tools is in the Standard group: a Server install has it, a Minimal Install does not. So ip and ss are on every normal server, ifconfig often is not. The ifconfig vs ip comparison shows both side by side.
Install the tools
# Debian and Ubuntu sudo apt install iproute2 iputils-ping traceroute mtr-tiny bind9-dnsutils netcat-openbsd curl tcpdump # AlmaLinux, Rocky Linux and RHEL sudo dnf install iproute iputils traceroute mtr bind-utils nmap-ncat tcpdump
We installed both sets in our tests. Add net-tools only if an old script still needs ifconfig or netstat. tcpdump needs root, so run it with sudo.
Official documentation: ip(8), ss(8) and tcpdump(1).
