Linux Networking — maks.top

Quick reference for Linux networking tools. Covers the modern stack: iproute2 (ip, ss), traffic capture (tcpdump), connection management (nmcli), and firewall (iptables).

ip addr

Address management

Command	Description
ip addr	Show all interfaces with addresses
ip a show dev eth0	Single interface only
ip a add 192.168.1.10/24 dev eth0	Add an IP address
ip a del 192.168.1.10/24 dev eth0	Remove an IP address
ip a flush dev eth0	Remove all addresses from an interface
ip -6 a	IPv6 addresses only
ip -br a	Brief output

ip link

Interface management

Command	Description
ip link show	List all interfaces
ip -br link	Brief output with statuses
ip link set eth0 up	Bring interface up
ip link set eth0 down	Bring interface down
ip link set eth0 mtu 9000	Set MTU (jumbo frames)
ip link set eth0 promisc on	Enable promiscuous mode
ip link set eth0 name lan0	Rename an interface
ip link add veth0 type veth peer name veth1	Create a veth pair
ip link add br0 type bridge	Create a bridge
ip link set eth0 master br0	Add interface to bridge
ip link del veth0	Delete an interface

ip route

Routing table

Command	Description
ip route	Show routing table
ip r show table all	All routing tables
ip r add default via 192.168.1.1	Set default gateway
ip r add 10.0.0.0/8 via 10.1.0.1 dev eth0	Add a static route
ip r del 10.0.0.0/8	Delete a route
ip r replace 10.0.0.0/8 via 10.2.0.1	Replace / upsert a route
ip r get 8.8.8.8	Route to a specific host
ip r add blackhole 10.10.0.0/16	Blackhole (silent drop)
ip r add prohibit 10.10.0.0/16	Reject with ICMP admin-prohibited
ip r flush cache	Flush route cache

ip neigh

ARP / NDP table

Command	Description
ip neigh show	Show ARP/NDP table
ip n show dev eth0	ARP for a specific interface
ip n add 192.168.1.1 lladdr aa:bb:cc:dd:ee:ff dev eth0 nud permanent	Add a static ARP entry
ip n del 192.168.1.1 dev eth0	Delete an ARP entry
ip n flush dev eth0	Flush ARP for an interface
ip n flush all	Flush the entire ARP cache

ss

Socket statistics (netstat replacement)

Command	Description
ss -tuln	Listening TCP/UDP ports
ss -tulnp	Same + process names (root)
ss -ta	All TCP connections
ss -ua	All UDP sockets
ss -xa	Unix domain sockets
ss -s	Socket summary statistics
ss -4 state established	Established IPv4 connections
ss -tnp dst 10.0.0.1	Connections to a specific host
ss -tnp dport = :443	Connections to port 443
ss -tnp sport = :22	Connections from port 22
ss -tnp state time-wait	Connections in TIME-WAIT state

ss flags: -t TCP · -u UDP · -l listening · -a all · -n no resolve · -p processes · -4/-6 IPv4/IPv6

tcpdump

Packet capture

Command	Description
tcpdump -i eth0	Capture on an interface
tcpdump -i any	Capture on all interfaces
tcpdump -i eth0 -n	No DNS resolution
tcpdump -i eth0 -nn	No DNS and no port name resolution
tcpdump -i eth0 -c 100	Capture 100 packets then exit
tcpdump -i eth0 -w file.pcap	Save to file (open in Wireshark)
tcpdump -r file.pcap	Read from file
tcpdump -i eth0 -v	Verbose output
tcpdump -i eth0 port 80	Filter by port
tcpdump -i eth0 host 10.0.0.1	Filter by host
tcpdump -i eth0 net 10.0.0.0/24	Filter by subnet
tcpdump -i eth0 src host 10.0.0.1	From source host only
tcpdump -i eth0 tcp and not port 22	TCP excluding SSH
tcpdump 'tcp[tcpflags] & tcp-syn != 0'	SYN packets only
tcpdump 'tcp[tcpflags] == tcp-syn\|tcp-ack'	SYN-ACK only (handshake)
tcpdump -i eth0 icmp	ICMP (ping) only
tcpdump -i eth0 udp port 53	DNS queries

nmcli

NetworkManager CLI

Command	Description
nmcli device status	Status of all devices
nmcli device show eth0	Detailed interface information
nmcli connection show	List all connections
nmcli connection show --active	Active connections only
nmcli con up "name"	Activate a connection
nmcli con down "name"	Deactivate a connection
nmcli con reload	Reload configuration files
nmcli con add type ethernet ifname eth0 con-name myconn	Create an Ethernet connection
nmcli con mod "name" ipv4.addresses "192.168.1.10/24"	Set a static IP
nmcli con mod "name" ipv4.gateway "192.168.1.1"	Set the gateway
nmcli con mod "name" ipv4.dns "8.8.8.8 1.1.1.1"	Set DNS servers
nmcli con mod "name" ipv4.method manual	Switch to static addressing
nmcli con mod "name" ipv4.method auto	Switch to DHCP
nmcli con del "name"	Delete a connection
nmcli general hostname myhost	Set the hostname
nmcli networking off / on	Disable / enable networking

iptables

Listing & flushing rules

Command	Description
iptables -L -n -v	All rules with counters
iptables -L INPUT --line-numbers	Rules with line numbers
iptables -t nat -L -n -v	NAT table
iptables -F	Flush all rules (filter table)
iptables -F INPUT	Flush INPUT chain only
iptables -X	Delete user-defined chains
iptables -Z	Zero counters
iptables -D INPUT 3	Delete rule #3 in INPUT

Common rules

Command	Description
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT	Allow established / related traffic
iptables -A INPUT -p tcp --dport 22 -j ACCEPT	Allow SSH
iptables -A INPUT -p tcp --dport 80,443 -j ACCEPT	Allow HTTP/HTTPS
iptables -A INPUT -i lo -j ACCEPT	Allow loopback
iptables -A INPUT -j DROP	Drop everything else
iptables -I INPUT 1 -s 10.0.0.0/8 -j ACCEPT	Insert rule at the top
iptables -A INPUT -p icmp -j ACCEPT	Allow ping
iptables -A INPUT -m limit --limit 3/min -j LOG --log-prefix "DROP: "	Log with rate limiting

NAT & Forwarding

Command	Description
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT	Allow forwarding
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE	NAT / masquerade (PAT)
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j SNAT --to-source 1.2.3.4	SNAT with a fixed IP
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:80	Port forwarding (DNAT)
iptables-save > /etc/iptables/rules.v4	Save rules
iptables-restore < /etc/iptables/rules.v4	Restore rules

Chains: INPUT (inbound to host) · OUTPUT (outbound from host) · FORWARD (transit) · PREROUTING · POSTROUTING
Tables: filter (default) · nat · mangle · raw