Chapter 19 Network Software Tools and Commands

ping

Sends ICMP echo requests to test connectivity and measure response time between hosts.

tracert / traceroute

Displays the path packets take to a destination host by reporting each hop along the route.

nslookup

Queries DNS servers to obtain domain name or IP address mapping information.

dig

A Linux DNS query tool for testing and troubleshooting DNS resolution.

tcpdump

A command-line packet sniffer in Linux that captures and displays network packets in real-time.

Wireshark

A GUI-based protocol analyzer used to capture and analyze network traffic at a detailed level.

netstat

Displays network connections, routing tables, interface statistics, and protocol usage.

ipconfig (Windows)

Displays or modifies a system's IP configuration.

ip (Linux)

A modern replacement for ifconfig, used to view and configure IP addresses and routing.

ifconfig

An older Linux utility used to configure or display network interface parameters.

arp

Displays and manages the ARP cache, which maps IP addresses to MAC addresses.

nmap

A network scanning tool that identifies live hosts, open ports, and operating systems.

LLDP (Link Layer Discovery Protocol)

A vendor-neutral protocol used by network devices to advertise identity and capabilities.

CDP (Cisco Discovery Protocol)

A Cisco proprietary protocol used for device discovery on Cisco networks.

iptables

A Linux firewall command-line utility that filters traffic using rules and chain types: input, output, and forward.

Toner Probe

Used with a tone generator to trace and identify cables.

Cable Tester

Verifies wiring integrity and detects shorts, opens, and miswires in cables.

Tap

A passive device that captures network traffic without modifying it.

Visual Fault Locator

Emits visible red light through fiber to help locate breaks or severe bends.

Wi-Fi Analyzer

Identifies wireless signal strength, interference, channel usage, and rogue access points.

Speed Tester

Measures upload and download speeds to evaluate connection performance.

show mac-address-table

Displays the MAC address table of a switch, showing learned addresses per port.

show route

Displays the routing table of a router.

show interface

Shows detailed status of network interfaces, including errors, speed, and duplex.

show config

Displays saved device configurations.

show arp

Displays the current ARP table on a device.

show vlan

Displays VLAN configurations and assignments.

show power

Shows power usage, often in relation to PoE devices.

Packet Sniffer

Captures and analyzes individual packets on a network segment to diagnose problems.

IDS/IPS

Intrusion Detection/Prevention Systems that monitor and optionally block suspicious traffic.

Port Scanner

Probes devices for open ports to identify services or security vulnerabilities.

tcpdump -i any

Captures packets from all network interfaces on a Linux host.

arp -a / arp -g

Displays the ARP table on a system, showing IP-to-MAC mappings.

netstat -a

Lists all active connections and listening ports.

ipconfig /all

Shows full IP configuration including DNS, gateway, and MAC address on Windows.

ping 127.0.0.1 / ping localhost

Verifies the local TCP/IP stack is functioning properly.

Common iptables Chains

Input: Filters packets coming into the local system. Output: Filters packets going out from the system. Forward: Filters packets being routed through the system.