Which Linux commands should a network engineer learn first?

Start with `ip`, `ping`, `traceroute`, `ss`, `dig`, `curl` and `tcpdump`. These commands cover interface inspection, routing, connectivity, DNS, ports, applications and packet analysis.

What is the replacement for ifconfig and netstat in Linux?

The `ip` command replaces most `ifconfig` and `route` tasks, while `ss` replaces most `netstat` use cases. Older tools may still exist, but iproute2 commands are preferred on modern Linux systems.

How can I check whether a port is open from Linux?

Use `nc -vz hostname port` to test remote TCP reachability. On the server, use `ss -tulpn` to confirm that the application is listening, then check host and cloud firewall rules.

How do I troubleshoot DNS problems on a Linux server?

Test the destination by IP address first, then query the hostname with `dig` or `resolvectl`. Check the configured resolvers, DNS response status, `/etc/resolv.conf` and any cloud-provided DNS settings.

Why can a cloud VM have internet access problems even with a correct Linux route?

Cloud connectivity also depends on subnet route tables, internet or NAT gateways, security groups, network security groups and network ACLs. The Linux route is only one component of the complete traffic path.

Do tcpdump commands require root access?

Packet capture normally requires root privileges or specific Linux capabilities, so `tcpdump` is commonly run with `sudo`. Capture only authorised traffic because packet files can contain sensitive information.

Essential Linux Commands for Network Engineers

Linux is the operating system behind many cloud virtual machines, network appliances, containers and automation platforms. A network or cloud engineer must be able to inspect interfaces, verify routes, test ports, analyse packets and investigate system services from the command line.

The commands below apply to common Linux distributions such as Ubuntu, Debian, Red Hat Enterprise Linux, Rocky Linux and Amazon Linux. Some tools may require installation, and administrative operations usually require sudo privileges.

1. Check Linux System and Host Information

Before troubleshooting, identify the server, operating system and kernel version. This is especially important when working with unfamiliar cloud instances.

hostname and hostnamectl

Use hostname to display the current system name:

hostname
hostname -I

hostname -I displays the IP addresses assigned to the host. On systems using systemd, hostnamectl provides more detail:

hostnamectl

To change the static hostname:

sudo hostnamectl set-hostname web-server-01

uname and OS release files

Check the running kernel and processor architecture:

uname -a
uname -r
uname -m

Identify the Linux distribution:

cat /etc/os-release

These details help determine package names, service behaviour and command availability.

2. Inspect Network Interfaces with ip

The ip command from the iproute2 suite is the standard tool for managing Linux interfaces, addresses and routes. It replaces older commands such as ifconfig and route for most tasks.

Display interfaces and IP addresses

ip address show
ip -br address
ip link show

The brief format is useful when a server has several interfaces. Interface states such as UP, DOWN and UNKNOWN indicate administrative and operational conditions.

To inspect one interface:

ip address show dev eth0

Cloud interface names may appear as eth0, ens5, ens160 or another predictable name.

Enable or disable an interface

sudo ip link set dev eth0 up
sudo ip link set dev eth0 down

Be careful when running these commands over SSH. Disabling the interface carrying your management session will disconnect you.

Add or remove an IP address

sudo ip address add 192.168.10.20/24 dev eth0
sudo ip address del 192.168.10.20/24 dev eth0

Changes made directly with ip are normally temporary and may disappear after a reboot. Use the distribution's network configuration system, such as NetworkManager or Netplan, for persistent settings.

3. Understand and Troubleshoot Routing

A host can have a valid IP address but still fail to communicate because of an incorrect route or gateway.

View the routing table

ip route show
ip -6 route show

A typical IPv4 default route looks like this:

default via 192.168.10.1 dev eth0

Find the route Linux will use for a particular destination:

ip route get 8.8.8.8

This displays the selected gateway, interface and source address. It is often more useful than reading a large routing table manually.

Add a temporary route

sudo ip route add 10.20.0.0/16 via 192.168.10.1
sudo ip route del 10.20.0.0/16 via 192.168.10.1

On AWS, Microsoft Azure and other clouds, remember that Linux routes are only one part of the path. You may also need to inspect virtual network route tables, security groups, network security groups, firewalls and network ACLs.

4. Test Reachability and Network Paths

ping

ping sends ICMP echo requests and measures reachability and round-trip time:

ping -c 4 8.8.8.8
ping -c 4 example.com
ping -6 -c 4 2001:4860:4860::8888

Testing an IP address separately from a hostname helps isolate DNS problems. However, a failed ping does not always mean the destination is unavailable because firewalls may block ICMP.

traceroute and tracepath

Use these commands to examine the Layer 3 path towards a destination:

traceroute example.com
tracepath example.com

Asterisks can indicate filtering, rate limiting or a router that does not return a response. They do not automatically prove packet loss at the final destination.

mtr

mtr combines repeated ping and traceroute-style results:

mtr example.com
mtr -rw -c 20 example.com

The report mode is useful for collecting evidence during an intermittent connectivity investigation. Interpret intermediate-hop loss carefully because routers may deprioritise diagnostic traffic while forwarding normal traffic correctly.

5. Check Listening Ports and Connections with ss

The ss command displays socket information and is the modern replacement for most netstat use cases.

ss -tuln
ss -tulpn
ss -tan

Common options include:

Option	Purpose
`-t`	Show TCP sockets
`-u`	Show UDP sockets
`-l`	Show listening sockets
`-a`	Show listening and connected sockets
`-n`	Display numeric addresses and ports
`-p`	Display associated processes where permitted

To check whether a web service is listening on port 443:

sudo ss -tulpn | grep ':443'

A service listening on 127.0.0.1:8080 accepts only local connections. A listener on 0.0.0.0:8080 accepts IPv4 connections through available interfaces, subject to firewall and cloud security rules.

6. Test DNS Resolution

DNS failures frequently appear to users as application or network failures.

dig

Use dig to query DNS records:

dig example.com
dig example.com A
dig example.com AAAA
dig example.com MX
dig +short example.com

Query a specific resolver:

dig @8.8.8.8 example.com

Review the status, answer section and query time. A response such as NXDOMAIN means the requested name does not exist according to DNS, while a timeout indicates that the resolver did not answer.

resolvectl and getent

On systems using systemd-resolved:

resolvectl status
resolvectl query example.com

To test name resolution through the system's configured Name Service Switch path:

getent hosts example.com

Also inspect /etc/resolv.conf, but note that it may be generated automatically by NetworkManager, systemd-resolved, DHCP or a cloud agent.

7. Test HTTP Services and TCP Ports

curl

curl is essential for checking APIs, websites, proxies and load balancers:

curl https://example.com
curl -I https://example.com
curl -v https://example.com

-I retrieves response headers, while -v shows connection, TLS and HTTP details. To display only the HTTP status code:

curl -sS -o /dev/null -w '%{http_code}\n' https://example.com

For an API returning JSON:

curl -sS https://api.example.com/health | jq .

Do not disable certificate verification with -k as a routine fix. Investigate the certificate name, validity period and trusted certificate authority instead.

netcat

Netcat, normally invoked as nc, can test whether a TCP port is reachable:

nc -vz server.example.com 22
nc -vz server.example.com 443

A successful connection confirms that the TCP handshake completed. It does not prove that the application is healthy or returning valid data.

8. Capture and Analyse Packets with tcpdump

tcpdump is one of the most valuable Linux troubleshooting tools. It helps confirm whether packets arrive, leave and receive responses.

List available capture interfaces:

sudo tcpdump -D

Capture traffic on an interface without resolving names or ports:

sudo tcpdump -i eth0 -nn

Apply capture filters to reduce unnecessary output:

sudo tcpdump -i eth0 -nn host 10.0.1.25
sudo tcpdump -i eth0 -nn port 53
sudo tcpdump -i eth0 -nn 'tcp port 443'
sudo tcpdump -i eth0 -nn 'icmp or icmp6'

Save packets for later analysis in Wireshark:

sudo tcpdump -i eth0 -nn -s 0 -w network-capture.pcap

Packet captures may contain credentials, tokens or business data. Store and share them securely, and capture only traffic you are authorised to inspect.

9. Inspect Interface and NetworkManager Settings

ethtool

For physical systems, ethtool can display link speed, duplex and driver information:

sudo ethtool eth0
sudo ethtool -i eth0
sudo ethtool -S eth0

Virtual machines may expose limited or synthetic information, so not every field is meaningful in a cloud environment.

nmcli

On distributions managed by NetworkManager, use nmcli to inspect devices and connections:

nmcli device status
nmcli connection show
nmcli connection show --active
nmcli device show eth0

Persistent address, gateway and DNS changes can also be made with nmcli, but verify the connection profile before modifying a remote server.

10. Manage Services and Review Logs

Network applications depend on services such as SSH, DNS resolvers, web servers and monitoring agents.

systemctl

systemctl status ssh
sudo systemctl restart ssh
systemctl is-active nginx
systemctl is-enabled nginx

The SSH unit may be named ssh or sshd, depending on the distribution. Check the available unit before restarting it.

journalctl

Use the systemd journal to investigate service failures:

journalctl -u nginx
journalctl -u nginx --since '30 minutes ago'
journalctl -p err -b
journalctl -f

-f follows new log entries in real time. Traditional application logs may also be stored under /var/log.

11. Monitor Processes, Memory and Storage

Performance problems can resemble network issues. High CPU usage, exhausted memory or a full filesystem may prevent an application from responding.

ps aux
top
free -h
df -h
du -sh /var/log/*
lsblk

Use ps with filters to locate a process:

ps aux | grep nginx
pgrep -a nginx

df -h reports filesystem capacity, while du estimates space used by files and directories. Do not confuse these two measurements.

12. Filter and Process Command Output

Linux engineers regularly combine commands using pipes.

ip -br address | grep UP
ss -tan | grep ESTAB
journalctl -u nginx | tail -n 50

Useful text-processing tools include:

grep for matching lines
awk for selecting and transforming fields
sed for stream editing
cut for extracting delimited columns
sort and uniq for grouping values
head and tail for limiting output
jq for processing JSON

For example, count established TCP connections by remote address:

ss -tn state established | awk 'NR>1 {print $5}' | sort | uniq -c | sort -nr

Always inspect sample output before building automation because fields can vary by command options and address format.

13. Transfer Files and Access Remote Systems Securely

ssh and scp

ssh admin@server.example.com
ssh -i ~/.ssh/cloud-key admin@203.0.113.10
scp report.txt admin@server.example.com:/tmp/

Protect private keys with restrictive permissions:

chmod 600 ~/.ssh/cloud-key

rsync

rsync efficiently copies files and can preserve attributes:

rsync -avz ./configs/ admin@server.example.com:/opt/configs/

Be careful with trailing slashes. ./configs/ copies the directory contents, while ./configs copies the directory itself.

14. Check Firewalls and Cloud Access Controls

Modern Linux distributions may use nftables directly or through a frontend such as firewalld or UFW.

sudo nft list ruleset
sudo firewall-cmd --list-all
sudo ufw status verbose

Use the command that matches the firewall installed on the server. Legacy environments may still use iptables -L -n -v.

For cloud workloads, verify every relevant control point:

Linux host firewall
AWS security groups and network ACLs
Azure network security groups
Cloud route tables and gateways
Load balancer listeners and health checks
Application binding address and listening port

A port must be allowed across the full path. Opening a Linux firewall alone does not override a blocked cloud security rule.

15. Build a Practical Troubleshooting Workflow

Use a consistent sequence instead of running random commands:

Confirm the hostname, operating system and recent changes.
Check interface state and assigned addresses with ip -br address.
Inspect the selected route with ip route get.
Test IP reachability, then test DNS resolution separately.
Verify the listening socket with ss -tulpn.
Test the application with curl or the port with nc.
Check service status and logs using systemctl and journalctl.
Review Linux firewall and cloud security rules.
Capture packets with tcpdump if the failure remains unclear.

These Linux commands are common in network operations, cloud support and DevOps roles in Chennai, Bangalore and across India. Practising them in a lab is more effective than memorising syntax because interviews and real incidents usually test troubleshooting logic as well as command knowledge.

Essential Linux Commands for Network and Cloud Engineers