Network+ Commands

tracert

Windows command that traces the route packets take to a destination (shows hops and latency)

(Linux) Display the kernel message log from the current boot.

journalctl -k and press Enter.

(Linux) Display the system log in reverse order with the newest entries first.

journalctl -r and press Enter.

tracert -h {MAX_HOPS}

Set maximum number of hops to search for target

traceroute

Linux/Unix command that traces the route packets take to a destination

netstat

Command to display active connections, routing tables, and network statistics

netstat -a

Show all connections and listening ports

netstat -n

Show addresses and ports numerically

netstat -o

Show owning process ID

netstat -r

Show routing table

netstat -q

Displays all connections, listening ports, and bound non-listening TCP ports. Bound non-listening ports may or may not be associated with an active connection.

nslookup

Command to query DNS and resolve {HOSTNAME} to {IP}

nslookup {HOSTNAME}

Query DNS for IP of {HOSTNAME}

nslookup {IP}

Reverse lookup of IP address

nslookup {HOSTNAME} {DNS-SERVER}

Query a {HOSTNAME} using a specific DNS server

nmap

Network scanner used to discover hosts and services

nmap {IP}

Basic scan of a target IP

nmap -sP {SUBNET}

Ping sweep of subnet

nmap -sV {IP}

Detect service versions

nmap -O {IP}

Detect operating system

dig

Command-line DNS lookup tool (Linux/Unix)

dig {HOSTNAME}

Look up IP for {HOSTNAME}

dig -x {IP}

Reverse lookup of IP

dig @{DNS-SERVER} {HOSTNAME}

Query using a specific DNS server

curl

Tool to transfer data from or to a server (supports HTTP, FTP, etc.)

curl {URL}

Fetch content from {URL}

curl -I {URL}

Fetch headers only

curl -o {FILE} {URL}

Save output to {FILE}

curl -L {URL}

Follow redirects

FIJI router

Commands for managing VyOS/Fiji-style routers

FIJI: show interfaces

Display all configured interfaces

FIJI: show configuration

Display full router config

FIJI: show ip route

Show routing table

FIJI: show service dhcp-server

Display DHCP server config (if set)

arp

Command to view and manipulate ARP cache

arp -a

Show current ARP table

arp -s {IP} {MAC}

Add static ARP entry

dnf

Package manager for Fedora/RHEL systems

dnf install {PACKAGE}

Install a package

dnf remove {PACKAGE}

Remove a package

dnf update

Update all packages

dnf list available

Displays a list of available packages to install

Most packages store their configs in what directory?

/etc/

sudo nano /etc/{PACKAGE_NAME}/{PACKAGE_NAME}.conf

sudo systemctl restart {SERVICE_NAME}

sudo systemctl status {SERVICE_NAME}

dnf list installed

Shows a list of all installed packages

dnf search {KEYWORD}

Search for a package

tcpdump

Command-line packet analyzer

tcpdump -i {INTERFACE}

Capture packets on {INTERFACE}

tcpdump -n

Do not resolve hostnames

tcpdump -nn

Do not resolve hostnames or ports

tcpdump port {PORT}

Capture traffic on {PORT}

tcpdump host {IP}

Capture traffic for specific host

tracert vs traceroute

tracert = Windows, traceroute = Linux/Unix

route

Command to view or modify IP routing table

How to add an IP route?

route ADD 157.0.0.0 MASK 255.0.0.0 157.55.80.1 METRIC 3 IF 2

destination^ mask^ gateway^ interface^

route -n

Show kernel routing table numerically (Linux)

route print

Show routing table (Windows)

How to view event logs on Windows?

Open powershell as admin, type get-eventlog -logname *

or get-eventlog -logname {name of log} to view specific log.

How to clear an event log on Windows?

Open powershell as admin, type clear-eventlog -logname {name of log}

journalctl

Show all system logs from the beginning

journalctl -f

Follow logs in real-time as they appear

journalctl -u {SERVICE_NAME}

Show logs for a specific service {SERVICE_NAME}

journalctl -n {NUMBER}

Show the last {NUMBER} log entries

journalctl -b

Show logs for the current boot only

Filter packets to/from the specified IP address {IP}

ip.addr == {IP}

Filter packets with source IP {IP}

ip.src == {IP}

Filter packets with destination IP {IP}

ip.dst == {IP}

Filter packets with TCP port {Port}

tcp.port == {Port}

Filter packets with UDP port {Port}

udp.port == {Port}

Filter all HTTP traffic

http

Filter all DNS traffic

dns

Filter all ARP packets

arp

Filter all ICMP packets (ping, traceroute)

icmp

Filter TCP SYN packets (connection attempts)

tcp.flags.syn == 1

Filter TCP FIN packets (connection termination)

tcp.flags.fin == 1

Filter TCP packets whose payload contains the text {Keyword}

tcp contains "Keyword"