Basic Network Commands Explained

A basic tools for testing connectivity to other hosts. It sends an internet control message protocol (ICMP) echo request to a host and listens for the reply. If a reply is received, it will display the time it took and the time to live (TTL) left. It has many options for setting attributes of the request, like the maximum TTL, IPv4/IPv6, and the number of requests to send. It is useful in troubleshooting connectivity with other devices. If a reply is not received, you will receive a timeout message, which could indicate connectivity issues, firewall issues, or both issues with the other device. In addition, due to the time to get a response, the latency between two devices can be measured, enabling a network engineer to troubleshoot performance problems or a network architect to determine where to place devices to minimize response time to other systems and users.

Ping

Commnand(s) used to trace the route an IP packet takes to a destination, displaying each hop (next router) in a numerical list.They are used to trace the route an IP packet takes to a destination. It displays each hop (next router) in a numerical list with the hop’s IP address and the time it takes to receive the packet. It can be useful in determining where a ping fails, troubleshooting performance issues, and other aspects regarding connectivity.

Traceroute/Tracert

Command similar to traceroute/tracert, it displays the path taken by a packet from its source to its destination, primarily used in Linux. It is useful because it can be used by any user instead of needing superuser privileges.

Tracepath

Provides the user with IP, subnet mask, and default gateway information for each network adapter, primarily used in Windows. Adding /release can be used to release all connections and renew all adapters.

Ipconfig

Used to configure kernel network interfaces, primarily used in Linux. It is implemented at the time of booting to configure the necessary interfaces. Once the interfaces are configured, it is used for debugging or tuning the system.

Ifconfig

Displays the IP to physical (MAC) address mappings for hosts in the ARP cache, used for adding, removing, or modifying entries. The hosts need to be on the local network, as these addresses are discovered by broadcasting to everyone on the network and noting the reply from the owner; broadcast traffic is not allowed through a router so that the system will maintain the MAC address of the router.

ARP

Displays information about active ports and their state, useful in troubleshooting and capacity management. Adding -r displays routing information for network adapters. It is available in Windows, MacOS, and Linux.

Netstat

Displays DNS information and troubleshoots DNS problems, useful in displaying names to IP address mappings.

Nslookup

Queries DNS name servers, helpful in troubleshooting DNS problems, and displays answers from the query. It is a replacement for nslookup.

Dig

Is a command that looks up who owns a domain or block of IP addresses on the internet, including name, email address, and physical address, primarily used in Linux. However, there are many privacy options that hide this information from being returned

Whois

Displays the current route tables on a host, used to add or remove routes. This is used by the local host to determine where to send traffic (0.0.0.0 means the default gateway, where the router sends things if it is not otherwise defined in the routing table).

Route

Securely copies files between servers leveraging SSH for authentication and encryption.

SCP

Copies files from one host to another host, data is unencrypted. If encryption is needed, it uses SSL/TLS (Secure Sockets Layer, replaced by Transport Layer Security; the same encryption used in https). Transfer uses TCP (transmission control protocol) for reliability and is often used on the internet and other wide-area networks, where errors may be more common.

FTP

Transfers files between client and server using UDP, usually used on reliable (local) networks.

TFTP

Displays information about a user or users on a remote system, including things such as last log-in time and username, primarily used in Linux.

Finger

Scans networks to find hosts and open ports, commonly used to determine what is deployed on a network for vulnerability analysis, security scans, and related activities. It is not native to either Linux or Windows but can be downloaded for free and used with both.

Nmap

The command traceroute is used for

Linux systems

The command tracert is used for

Windows systems.

Command that displays TCP/IP packets and other network packets that are being transmitted over the network system. It is a form of protocol analyzer (sometimes called a sniffer) and is designed to show the contents of network packets in human-readable form for troubleshooting, security analysis, etc. It is not native to either Linux or Windows but can be downloaded for free and used with both.

### tcpdump

Command(s) that allow a user to manage accounts and devices remotely. The main difference between the two is that one is encrypted, and thus all data is secure from eavesdropping, while the other is unencrypted.

### telnet/ssh