2.3.2. Network Diagnostics and Common Tools

💡 First Principle: Network troubleshooting is a process of elimination from Layer 1 upward. Is the link up? Can I ping the gateway? Can I resolve DNS? Can I reach the destination? Each question narrows the failure domain. The diagnostic tools on Linux map cleanly to these layers.

Essential Network Tools:

# Interface and address inspection
ip address show                   # All interfaces and IP addresses (ip a)
ip link show                      # Link state, MAC, MTU
ip route show                     # Routing table
ip route get 8.8.8.8              # Which route will be used for a destination

# Connectivity testing
ping -c 4 192.168.1.1             # ICMP echo to gateway
ping6 ::1                         # IPv6 ping
traceroute 8.8.8.8                # Path with per-hop RTT
tracepath 8.8.8.8                 # traceroute without root (also finds MTU)
mtr 8.8.8.8                       # Combined ping + traceroute, live updating

# Socket and port inspection
ss -tulnp                         # Show all listening TCP/UDP sockets with PID
ss -s                             # Socket statistics summary
# ss replaces netstat; -t=tcp -u=udp -l=listening -n=numeric -p=process

# DNS tools
dig google.com                    # Full DNS lookup with all records
dig google.com A @8.8.8.8         # Query specific nameserver for A record
nslookup google.com               # Simple DNS lookup (interactive or one-shot)
resolvectl status                 # systemd-resolved status and active DNS servers
hostname                          # Show or set system hostname

# Application-layer testing
curl -I https://example.com       # HTTP headers only (test web server)
curl -v https://example.com       # Verbose, shows TLS handshake
nc -zv 192.168.1.10 443           # Test TCP port reachability (netcat)
nc -l 8080                        # Listen on port 8080 (simple server for testing)

# Network analysis
tcpdump -i ens3 port 80           # Capture HTTP traffic on interface
tcpdump -i any -w /tmp/cap.pcap   # Write capture to file for Wireshark
nmap -sV 192.168.1.0/24           # Scan network, detect services
arp -n                            # ARP table (MAC-to-IP mappings)
ethtool ens3                      # Physical link status, speed, duplex
iperf3 -s                         # Run iperf3 server (bandwidth testing)
iperf3 -c 192.168.1.10            # Run iperf3 client against server

⚠️ Exam Trap: ss is the modern replacement for netstat — both show socket information, but netstat is deprecated and may not be installed. The exam tests ss. Remember the flags: -tulnp shows all TCP and UDP Listening sockets with Numeric addresses and Process information.

Reflection Question: A developer reports that their application "can't connect to the database" on port 5432. Using only ss and ping, walk through the diagnostic steps to determine whether the problem is (a) the database isn't listening, (b) a firewall is blocking the port, or (c) a routing problem.