Network Configuration and Troubleshooting

Category: Advanced Linux Administration
Type: Linux Commands
Generated on: 2025-07-10 03:14:57
For: System Administration, Development & Technical Interviews

Linux Network Configuration & Troubleshooting Cheatsheet (Advanced)

This cheatsheet provides a comprehensive guide to network configuration and troubleshooting on Linux systems. It’s designed for both sysadmins and developers, covering essential commands, practical examples, and advanced techniques.

1. Command Overview

This section lists commands used to configure, monitor, and troubleshoot network interfaces, routing, DNS, and network services.

2. Basic Syntax

This section defines the general structure and common options for each command.

3. Practical Examples

This section showcases real-world usage scenarios with sample commands and expected output.

4. Common Options

This section highlights the most useful flags and parameters for each command.

5. Advanced Usage

This section demonstrates complex examples and command combinations.

6. Tips & Tricks

This section offers pro tips and shortcuts for efficient network management.

7. Troubleshooting

This section addresses common errors and provides solutions.

8. Related Commands

This section lists related commands and alternatives for specific tasks.

I. Network Interface Configuration

1. ip - Network Configuration Utility

Command Overview: A powerful tool to manage network interfaces, addresses, routes, and tunnels. Replaces older tools like ifconfig and route.
Basic Syntax: ip [OPTIONS] OBJECT {COMMAND | help}
- OBJECT: link, addr, route, tunnel, neigh (ARP)

Practical Examples:

# Show all network interfaces
ip link show

# Output example:
# 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
#     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
# 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
#     link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff

# Show IP address information for eth0
ip addr show eth0

# Output example:
# 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
#     link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff
#     inet 192.168.1.10/24 brd 192.168.1.255 scope global eth0
#        valid_lft forever preferred_lft forever
#     inet6 fe80::a8bb:ccff:fedd:eeff/64 scope link
#        valid_lft forever preferred_lft forever

# Add an IP address to eth0
sudo ip addr add 192.168.1.20/24 dev eth0

# Delete an IP address from eth0
sudo ip addr del 192.168.1.20/24 dev eth0

# Bring an interface up
sudo ip link set dev eth0 up

# Bring an interface down
sudo ip link set dev eth0 down

Common Options:
- link show: Show network interfaces
- addr show: Show IP addresses
- route show: Show routing table
- link set: Modify link attributes (up/down, MTU, etc.)
- addr add: Add an IP address
- addr del: Delete an IP address

Advanced Usage:

# Create a virtual ethernet pair (veth)
sudo ip link add veth0 type veth peer name veth1

# Assign IP addresses to the veth pair
sudo ip addr add 10.0.0.1/24 dev veth0
sudo ip addr add 10.0.0.2/24 dev veth1

# Bring up the veth interfaces
sudo ip link set dev veth0 up
sudo ip link set dev veth1 up

Tips & Tricks:
- Use ip -c for colorized output, making it easier to read.
- Use tab completion to explore available options and objects.
Troubleshooting:
- RTNETLINK answers: File exists: Address already assigned.
- RTNETLINK answers: No such device: Interface name incorrect.
Related Commands: ifconfig (deprecated), route (deprecated), netstat (deprecated). ss is better than netstat.

2. ifconfig - (Deprecated) Network Interface Configuration

Command Overview: A legacy command for configuring and displaying network interface information. Largely superseded by ip. Use ip instead. However, useful for quick information gathering on older systems.
Basic Syntax: ifconfig [INTERFACE] [OPTIONS]

Practical Examples:

# Show all network interfaces
ifconfig -a

# Show information for eth0
ifconfig eth0

# Assign an IP address and netmask to eth0
sudo ifconfig eth0 192.168.1.10 netmask 255.255.255.0

# Bring an interface up
sudo ifconfig eth0 up

# Bring an interface down
sudo ifconfig eth0 down

Common Options:
- -a: Show all interfaces, including inactive ones.
- up: Activate the interface.
- down: Deactivate the interface.
Advanced Usage: Less versatile than ip, advanced usage is limited.
Tips & Tricks: Use ip instead whenever possible.
Troubleshooting: Often requires sudo for configuration changes.
Related Commands: ip, route, netstat.

3. nmcli - NetworkManager Command-Line Interface

Command Overview: A command-line tool for controlling NetworkManager, which manages network connections. Useful for managing connections, devices, and setting up VPNs.
Basic Syntax: nmcli [OPTIONS] OBJECT {COMMAND | help}
- OBJECT: connection, device, networking

Practical Examples:

# Show all network connections
nmcli connection show

# Show status of all network devices
nmcli device status

# Show details about the eth0 device
nmcli device show eth0

# Activate a connection named "MyWiredConnection"
nmcli connection up "MyWiredConnection"

# Deactivate a connection named "MyWiredConnection"
nmcli connection down "MyWiredConnection"

# Create a new wired connection (Requires more parameters in real usage)
# nmcli connection add con-name "MyNewConnection" type ethernet ifname eth0 ip4 192.168.1.30/24 gw4 192.168.1.1

#Modify a connection
#nmcli connection modify "MyNewConnection" ipv4.dns "8.8.8.8,8.8.4.4"

Common Options:
- connection show: List network connections.
- device status: Show device status.
- connection up: Activate a connection.
- connection down: Deactivate a connection.
- connection add: Create a new connection.
- connection modify: Modify an existing connection.
- connection delete: Delete an existing connection.

Advanced Usage:

# Create a VPN connection (requires specific VPN configuration)
# nmcli connection add type vpn con-name "MyVPN" ifname "*" vpn.service-type openvpn vpn.data "username=myuser,password=mypass,remote=vpn.example.com"
# nmcli connection up MyVPN

Tips & Tricks:
- Use nmcli con show to find connection names.
- Use nmcli device show <device> to see the current connection assigned to a device.
Troubleshooting:
- Check NetworkManager logs: /var/log/syslog or journalctl -u NetworkManager
- Ensure NetworkManager service is running: systemctl status NetworkManager
Related Commands: networkctl, systemctl.

II. Routing Configuration

1. ip route - Manage Routing Table

Command Overview: Used for displaying and manipulating the routing table.
Basic Syntax: ip route {add | del | show | flush} [OPTIONS]

Practical Examples:

# Show the routing table
ip route show

# Output example:
# default via 192.168.1.1 dev eth0
# 192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.10

# Add a route to the 10.0.0.0/24 network via 192.168.1.1
sudo ip route add 10.0.0.0/24 via 192.168.1.1

# Delete a route to the 10.0.0.0/24 network
sudo ip route del 10.0.0.0/24

# Add a default route
sudo ip route add default via 192.168.1.1 dev eth0

# Flush the entire routing table (USE WITH CAUTION!)
# sudo ip route flush cache   #Flushes the cache only
# sudo ip route flush all     #Flushes all routes

Common Options:
- show: Display the routing table.
- add: Add a new route.
- del: Delete an existing route.
- default: Specifies the default gateway.
- via: Specifies the gateway IP address.
- dev: Specifies the outgoing interface.

Advanced Usage:

# Add a route with a specific metric (lower metric = higher priority)
sudo ip route add 10.0.0.0/24 via 192.168.1.1 metric 100

# Add a route for a specific source address
sudo ip route add 10.0.0.0/24 via 192.168.1.1 src 192.168.1.10

Tips & Tricks:
- Use ip route get <destination> to find the route used for a specific destination.
Troubleshooting:
- Network is unreachable: No route to the destination.
- Gateway X.X.X.X is not on the same broadcast domain as device Y: Gateway and interface are on different networks.
Related Commands: route (deprecated), traceroute, ping.

2. route - (Deprecated) Manipulate Routing Table

Command Overview: A legacy command for managing the routing table. Largely superseded by ip route. Use ip route instead.
Basic Syntax: route [OPTIONS] [COMMAND] destination [gw GATEWAY]

Practical Examples:

# Show the routing table
route -n

# Add a route to the 10.0.0.0/24 network via 192.168.1.1
sudo route add -net 10.0.0.0 netmask 255.255.255.0 gw 192.168.1.1

# Delete a route to the 10.0.0.0/24 network
sudo route del -net 10.0.0.0 netmask 255.255.255.0

# Add a default route
sudo route add default gw 192.168.1.1

Common Options:
- -n: Display numerical addresses instead of hostnames.
- add: Add a new route.
- del: Delete an existing route.
- default: Specifies the default gateway.
Advanced Usage: Less versatile than ip route, advanced usage is limited.
Tips & Tricks: Use ip route instead whenever possible.
Troubleshooting: Often requires sudo for configuration changes.
Related Commands: ip route, netstat.

III. DNS Configuration & Troubleshooting

1. dig - DNS Lookup Utility

Command Overview: A powerful tool for querying DNS servers and retrieving information about domain names.
Basic Syntax: dig [OPTIONS] name [type] [query options]

Practical Examples:

# Perform a basic DNS lookup for example.com
dig example.com

# Output example (truncated):
# ;; ANSWER SECTION:
# example.com.        141 IN  A   93.184.216.34

# Query a specific DNS server
dig @8.8.8.8 example.com

# Query for MX records
dig example.com MX

# Query for NS records
dig example.com NS

# Query for all record types (ANY) - Use with caution, can return a lot of data
dig example.com ANY

Common Options:
- @server: Specify a DNS server to query.
- MX: Query for MX (mail exchange) records.
- NS: Query for NS (name server) records.
- A: Query for A (address) records.
- CNAME: Query for CNAME (canonical name) records.
- ANY: Query for all record types. Use with caution.
- +trace: Trace the DNS resolution path.
- +short: Display only the answer section.

Advanced Usage:

# Perform a reverse DNS lookup
dig -x 8.8.8.8

# Batch DNS lookups from a file
dig -f domains.txt

Tips & Tricks:
- Use dig +trace example.com to trace the DNS resolution process.
- Use dig +short example.com for a concise output.
- Use dig -t axfr <domain> @<nameserver> for a zone transfer. This is often restricted and should only be used with explicit permission.
Troubleshooting:
- connection timed out; no servers could be reached: DNS server unreachable.
- SERVFAIL: DNS server encountered an error.
- NXDOMAIN: Domain name does not exist.
Related Commands: nslookup, host, ping, traceroute.

2. nslookup - (Deprecated) DNS Lookup Utility

Command Overview: A legacy DNS lookup tool. Largely superseded by dig. dig is preferred.
Basic Syntax: nslookup [OPTIONS] [name | -] [server]

Practical Examples:

# Perform a basic DNS lookup for example.com
nslookup example.com

# Query a specific DNS server
nslookup example.com 8.8.8.8

# Change to query for MX records
nslookup
> set type=MX
> example.com

Common Options:
- server: Specify a DNS server to query.
- set type=: Set the query type (e.g., MX, NS, A).
Advanced Usage: Less versatile than dig, advanced usage is limited.
Tips & Tricks: Use dig instead whenever possible.
Troubleshooting: Often provides less detailed information than dig.
Related Commands: dig, host, ping, traceroute.

3. host - DNS Lookup Utility

Command Overview: A simple DNS lookup utility.
Basic Syntax: host [OPTIONS] name [server]

Practical Examples:

# Perform a basic DNS lookup for example.com
host example.com

# Query a specific DNS server
host example.com 8.8.8.8

# Query for MX records
host -t mx example.com

Common Options:
- -t: Specify the record type (e.g., mx, ns, a).
- server: Specify a DNS server to query.
Advanced Usage: Limited compared to dig.
Tips & Tricks: A quick and easy alternative to dig for basic lookups.
Troubleshooting: Provides less detailed information than dig.
Related Commands: dig, nslookup, ping, traceroute.

4. /etc/resolv.conf - DNS Resolver Configuration File

Command Overview: This file specifies the DNS servers that the system will use for name resolution. Often managed by NetworkManager or systemd-resolved.

Basic Syntax:

nameserver <IP_ADDRESS>
search <domain_list>
options <options>

Practical Examples:

# Example /etc/resolv.conf
nameserver 8.8.8.8
nameserver 8.8.4.4
search example.com
options timeout:1 attempts:2

Common Options:
- nameserver: Specifies a DNS server IP address.
- search: Specifies a list of domains to search when resolving unqualified hostnames.
- options: Specifies resolver options (e.g., timeout, attempts).
Advanced Usage:
- Be cautious when manually editing this file, as changes might be overwritten by NetworkManager or systemd-resolved. Use the appropriate management tools instead.
Tips & Tricks:
- Use resolvectl status to check the status of systemd-resolved.
- Use nmcli dev show <device> to check the DNS servers configured by NetworkManager.
Troubleshooting:
- If DNS resolution is failing, check that the DNS server IP addresses are correct and reachable.
- Check that the search domain list is configured correctly.
Related Commands: dig, nslookup, resolvectl.

IV. Network Monitoring & Troubleshooting

1. ping - Test Network Connectivity

Command Overview: A basic tool for testing network connectivity by sending ICMP echo requests to a target host.
Basic Syntax: ping [OPTIONS] destination

Practical Examples:

# Ping example.com
ping example.com

# Ping 8.8.8.8
ping 8.8.8.8

# Ping with a specific packet size
ping -s 1000 example.com

# Ping continuously until interrupted
ping -t example.com  # In some environments, use -i instead of -t for interval

Common Options:
- -c count: Send a specified number of packets.
- -s size: Specify the packet size.
- -t ttl: Set the Time To Live. On some systems -i specifies interval.

Advanced Usage:

# Ping with a specific source IP address
sudo ping -I eth0 8.8.8.8  # Requires sudo because it may involve raw sockets

# Ping with a specific interval
sudo ping -i 0.2 example.com #Requires sudo due to use of short interval

Tips & Tricks:
- Use ping -c 4 example.com to send 4 packets and then stop.
- High packet loss or long round-trip times indicate network problems.
Troubleshooting:
- Destination Host Unreachable: No route to the destination.
- Request timeout: No response from the destination.
Related Commands: traceroute, mtr, tcpdump.

2. traceroute / tracepath - Trace Route to Destination

Command Overview: Traces the route packets take to reach a destination by displaying each hop along the path. tracepath doesn’t require root.
Basic Syntax: traceroute [OPTIONS] destination tracepath [OPTIONS] destination

Practical Examples:

# Trace the route to example.com
traceroute example.com

# Trace the route to example.com using ICMP
traceroute -I example.com

#Tracepath to example.com
tracepath example.com

Common Options:
- -I: Use ICMP instead of UDP for tracing.
- -m max_hops: Set the maximum number of hops.

Advanced Usage:

# Trace the route with a specific source IP address
sudo traceroute -s 192.168.1.10 example.com

# Trace the route using TCP SYN packets
traceroute -T -p 80 example.com

Tips & Tricks:
- traceroute can help identify where network latency or packet loss is occurring.
- If a hop shows asterisks (* * *), it indicates that the hop is not responding to traceroute probes.
Troubleshooting:
- Timeouts at specific hops indicate network problems or firewalls blocking traffic.
- Inconsistent routes can indicate routing issues.
Related Commands: ping, mtr, tcpdump.

3. mtr - Network Diagnostic Tool (Combined Ping & Traceroute)

Command Overview: A combination of ping and traceroute, providing real-time network statistics for each hop along the route to a destination.
Basic Syntax: mtr [OPTIONS] destination

Practical Examples:

# Run mtr to example.com
mtr example.com

# Run mtr in report mode (text-based report)
mtr -r -c 10 example.com > report.txt

Common Options:
- -r: Report mode (text-based).
- -c count: Number of pings to send in report mode.
- -n: Do not resolve hostnames.
- -z: Specify initial ping size.

Advanced Usage:

# Run mtr with a specific interface
mtr -i eth0 example.com

Tips & Tricks:
- mtr provides a continuous view of network performance, making it easier to identify intermittent issues.
- Use report mode (-r) to generate a text-based report for later analysis.
Troubleshooting:
- High packet loss or latency at specific hops indicates network problems.
Related Commands: ping, traceroute, tcpdump.

4. tcpdump - Packet Analyzer

Command Overview: A powerful command-line packet analyzer that captures and displays network traffic. Requires root privileges.
Basic Syntax: tcpdump [OPTIONS] [expression]

Practical Examples:

# Capture all traffic on the eth0 interface
sudo tcpdump -i eth0

# Capture traffic to or from port 80
sudo tcpdump -i eth0 port 80

# Capture traffic to a specific host
sudo tcpdump -i eth0 host example.com

# Capture traffic to a specific network
sudo tcpdump -i eth0 net 192.168.1.0/24

# Capture only TCP packets
sudo tcpdump -i eth0 tcp

# Capture only ICMP packets
sudo tcpdump -i eth0 icmp

# Write the captured packets to a file
sudo tcpdump -i eth0 -w capture.pcap

Common Options:
- -i interface: Specify the interface to capture traffic on.
- -w file: Write the captured packets to a file (pcap format).
- -r file: Read packets from a file (pcap format).
- -n: Do not resolve hostnames or port numbers.
- -v, -vv, -vvv: Increase verbosity.
- port: Filter by port number.
- host: Filter by host address.
- net: Filter by network address.
- tcp, udp, icmp: Filter by protocol.

Advanced Usage:

# Capture packets with a specific TCP flag set (e.g., SYN)
sudo tcpdump -i eth0 "tcp[tcpflags] & tcp-syn != 0"

# Capture packets larger than a specific size
sudo tcpdump -i eth0 "greater 1000"

# Capture packets and save them to a ring buffer
sudo tcpdump -i eth0 -w capture.pcap -G 60 -W 5  # rotate files every 60 seconds, keep 5 files.

Tips & Tricks:
- Use filters to narrow down the captured traffic and avoid overwhelming the output.
- Use -n to avoid DNS lookups, which can slow down the capture process.
- Use Wireshark to analyze pcap files graphically.
Troubleshooting:
- tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes: tcpdump is running and capturing traffic.
- No output: No traffic matching the specified filter.
- tcpdump: pcap_loop: The interface on which the dump was started is no longer up: Interface went down during capture.
Related Commands: tshark (Wireshark command-line tool), wireshark, netstat, ss.

5. ss - Socket Statistics

Command Overview: A modern replacement for netstat that provides more detailed information about network sockets. Faster and more efficient than netstat.
Basic Syntax: ss [OPTIONS] [FILTER]

Practical Examples:

# Show all TCP sockets
ss -t -a

# Show all listening TCP sockets
ss -t -l

# Show all UDP sockets
ss -u -a

# Show sockets connected to port 80
ss -t -a port = 80

# Show sockets connected to a specific IP address
ss -t -a dst 192.168.1.10

#Show the process using the socket
ss -p

#Show summary statistics
ss -s

Common Options:
- -t: Show TCP sockets.
- -u: Show UDP sockets.
- -a: Show all sockets.
- -l: Show listening sockets.
- -p: Show the process using the socket.
- -n: Do not resolve service names.
- -s: Show summary statistics.

Advanced Usage:

# Show TCP sockets in state ESTABLISHED
ss -t state established

# Show sockets with a specific local address and port
ss -t -a src 192.168.1.10:22

Tips & Tricks:
- ss is much faster and more efficient than netstat.
- Use filters to narrow down the output and find specific sockets.
Troubleshooting:
- State column indicates the current state of the socket (e.g., ESTABLISHED, LISTEN, CLOSE_WAIT).
- Recv-Q and Send-Q columns indicate the number of bytes in the receive and send queues, respectively. High values can indicate network congestion or application issues.
Related Commands: netstat (deprecated), tcpdump, lsof.

6. netstat - (Deprecated) Network Statistics

Command Overview: A legacy tool for displaying network connections, routing tables, interface statistics, and masquerade connections. Largely superseded by ss and ip.
Basic Syntax: netstat [OPTIONS]

Practical Examples:

# Show all active network connections
netstat -a

# Show listening ports
netstat -l

# Show TCP connections
netstat -t

# Show UDP connections
netstat -u

# Show routing table
netstat -r

# Show interface statistics
netstat -i

# Show the program using the socket
netstat -p

Common Options:
- -a: Show all sockets (both listening and non-listening).
- -l: Show only listening sockets.
- -t: Show TCP sockets.
- -u: Show UDP sockets.
- -r: Show routing table.
- -i: Show interface statistics.
- -n: Do not resolve service names.
- -p: Show the process ID and name associated with each socket.
Advanced Usage: Limited compared to ss.
Tips & Tricks: Use ss instead whenever possible.
Troubleshooting: netstat provides less detailed information and is slower than ss.
Related Commands: ss, tcpdump, lsof.

7. lsof - List Open Files

Command Overview: Lists all open files and the processes that are using them. Can be used to identify which processes are using specific network ports.
Basic Syntax: lsof [OPTIONS] [file...]

Practical Examples:

# List all open files
lsof

# List open files associated with a specific process ID
lsof -p 1234

# List open files associated with a specific user
lsof -u username

# List open files associated with a specific network port
lsof -i :80

# List open files associated with a specific TCP connection
lsof -i TCP:22

# List open files associated with a specific UDP port
lsof -i UDP:53

Common Options:
- -p pid: List files opened by process ID.
- -u user: List files opened by user.
- -i [protocol][@hostname|hostaddr][:port]: List files opened by network connection.

Advanced Usage:

# Find the process listening on port 80
lsof -i :80

# Find all processes listening on any port
lsof -i -n -P | grep LISTEN

Tips & Tricks:
- lsof can be used to identify which processes are preventing a network port from being bound.
- Use -n to avoid hostname lookups, which can speed up the command.
- Use -P to avoid port name lookups.
Troubleshooting:
- No output: No processes are using the specified file or network connection.
- Multiple processes using the same port: A configuration error.
Related Commands: ss, netstat, ps.

V. Firewall Configuration

1. iptables - (Legacy) Firewall Configuration

Command Overview: A legacy command-line firewall utility that allows you to configure the Linux kernel’s built-in packet filtering system. Largely superseded by nftables. Still important to understand.
Basic Syntax: iptables [OPTIONS] command [chain] [rule-specification]

Practical Examples:

# List all iptables rules
sudo iptables -L

# List all iptables rules with verbose output
sudo iptables -L -v

# List all iptables rules with numeric output (no DNS lookups)
sudo iptables -L -n

# Flush all iptables rules (USE WITH CAUTION!)
sudo iptables -F

# Set the default policy for the INPUT chain to DROP
sudo iptables -P INPUT DROP

# Allow incoming SSH traffic
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow outgoing HTTP traffic
sudo iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT

# Allow incoming ping requests
sudo iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Block traffic from a specific IP address
sudo iptables -A INPUT -s 192.168.1.10 -j DROP

# Save iptables rules
sudo iptables-save > /etc/iptables/rules.v4

Common Options:
- -A chain: Append a new rule to the specified chain.
- -D chain rule-number: Delete a rule from the specified chain by rule number.
- -D chain rule-specification: Delete a rule from the specified chain by rule specification.
- -I chain rule-number: Insert a new rule at the specified position in the chain.
- -R chain rule-number: Replace a rule in the specified chain.
- -L: List all rules in the specified chain.
- -F: Flush all rules in the specified chain.
- -P chain target: Set the default policy for the specified chain.
- -s source: Specify the source IP address or network.
- -d destination: Specify the destination IP address or network.
- `-