Net+ CLI

ping -t - Windows

Continuously pings the specified host until interrupted (Ctrl+C).

ping -n [count] - Windows

Sends a specified number of ECHO requests instead of the default 4.

ping -l [size] - Windows

Specifies the send buffer size (payload size in bytes) to test MTU / packet fragmentation.

ping -4 / ping -6 - Windows/Linux

Forces ping to resolve addresses and route strictly using IPv4 or IPv6.

ping -c [count] - Linux

Sends a specific count of ICMP ECHO packets and terminates automatically.

ping -i [interval] - Linux

Specifies the wait time interval (in seconds) between sending each packet.

traceroute (Linux) / tracert (Windows) - Traces the hop-by-hop layer 3 route packets take to a remote host using TTL increments.

tracert -d - Windows

Prevents tracert from resolving IP addresses to hostnames (speeds up output).

tracert -h [max_hops] - Windows

Sets the maximum number of hops to search for the target.

traceroute -n - Linux

Displays raw IP addresses numerically without performing reverse DNS lookups.

traceroute -I - Linux

Directs traceroute to use ICMP ECHO requests instead of default UDP probes.

traceroute -T - Linux

Directs traceroute to use TCP SYN packets (useful for bypassing firewalls blocking UDP/ICMP).

pathping [host] - Windows

Combines ping and tracert over 5-25 minutes to compute per-hop latency and packet loss metrics.

pathping -n - Windows

Instructs pathping to not resolve addresses to hostnames.

pathping -q [queries] - Windows

Specifies the number of queries per hop (default is 100).

ipconfig - Windows

Displays basic IP address, subnet mask, and default gateway for all network adapters.

ipconfig /all - Windows

Displays full network configuration, including MAC address, DHCP lease times, and DNS servers.

ipconfig /release - Windows

Releases current DHCP configuration by sending a DHCPRELEASE packet.

ipconfig /renew - Windows

Requests new DHCP configuration from a DHCP server (DHCPREQUEST).

ipconfig /flushdns - Windows

Clears the local client DNS resolver cache.

ipconfig /displaydns - Windows

Outputs the current contents of the local client DNS cache.

ifconfig (Deprecated Linux) - Legacy Linux utility to display and modify network interface IP configurations.

ip addr (ip a) - Linux

Displays IP addresses and interface properties for all network interfaces (iproute2 suite).

ip link set [interface] up/down - Linux

Activates or disables a specified network interface link.

ip route show - Linux

Displays the current kernel routing table.

ip route add default via [ip] - Linux

Configures the default gateway on a Linux host.

netstat -a - Displays all active TCP connections and listening TCP/UDP ports.

netstat -n - Displays active connections with numerical addresses and port numbers instead of resolving names.

netstat -b - Windows

Displays the executable program name involved in creating each connection or listening port.

netstat -o - Windows

Displays the owning Process ID (PID) associated with each active network connection.

netstat -r - Displays the current IP routing table (equivalent to 'route print' on Windows).

netstat -p [proto] - Windows

Filters output by specific protocol (e.g., TCP, UDP, IPv6).

ss -tuln - Linux

Modern socket statistics replacement for netstat showing listening (l) TCP (t) and UDP (u) sockets without DNS resolution (n).

ss -p - Linux

Shows which process/PID owns each open socket connection.

route print - Windows

Displays the current active IPv4 and IPv6 routing tables and persistent routes.

route add [destination] mask [netmask] [gateway] - Windows

Adds a static route to the routing table.

route add -p - Windows

Makes an added static route persistent across system reboots.

route delete [destination] - Windows

Removes a specified static route from the system routing table.

nslookup [name_or_ip] - Queries DNS servers interactively or non-interactively to resolve domain names or IP records.

nslookup -type=[record_type] - Specifies DNS query type (e.g., A, AAAA, MX, CNAME, PTR, TXT, SOA).

nslookup [target] [server_ip] - Queries a specific DNS server directly rather than the system's configured default resolver.

dig [domain] - Linux

Versatile DNS lookup tool that queries DNS servers and outputs hierarchical resolution details.

dig [domain] [record_type] - Linux

Queries a domain for specific record types like MX, TXT, A, or NS.

dig @[server_ip] [domain] - Linux

Directs a dig lookup to query a specific external DNS server directly.

dig +trace [domain] - Linux

Performs iterative resolution from root DNS servers down to the authoritative name server.

dig -x [ip] - Linux

Performs a reverse DNS lookup to find the domain associated with an IP address.

arp -a - Displays current ARP cache entries mapping IPv4 addresses to physical MAC addresses.

arp -d [ip] - Deletes an entry from the ARP cache (use '*' to clear entire table).

arp -s [ip] [mac] - Adds a static, permanent address mapping into the local ARP table.

ip neigh - Linux

Modern iproute2 replacement for arp; displays current neighbor cache (ARP/NDP).

tcpdump -i [interface] - Linux

Captures live packet traffic traversing a specified network interface.

tcpdump -w [filename.pcap] - Linux

Writes raw captured packets directly to a .pcap file for analysis in Wireshark.

tcpdump -r [filename.pcap] - Linux

Reads and parses packets from an existing packet capture file.

tcpdump -nn - Linux

Disables hostname and port name resolution, displaying raw numeric IPs and port numbers.

tcpdump port [port_number] - Linux

Packet filter expression capturing traffic sent to or from a designated port.

nmap -sS - Performs a TCP SYN stealth scan (half-open scan without completing three-way handshake).

nmap -