# List all interfaces (brief)
ip link show
ip -br link show          # brief: one line per interface
ip -c link show           # colorized output

# Show a specific interface
ip link show dev eth0

# Bring interface up/down
ip link set eth0 up
ip link set eth0 down

# Set MTU
ip link set eth0 mtu 9000

# Rename interface
ip link set eth0 name lan0

# Create/delete a VLAN
ip link add link eth0 name eth0.100 type vlan id 100
ip link delete eth0.100

# Create a veth pair (used in containers/netns)
ip link add veth0 type veth peer name veth1

# Create a bridge
ip link add br0 type bridge
ip link set eth0 master br0

# Show all addresses
ip addr show
ip -br addr show          # brief one-liner per interface

# Show addresses on a specific interface
ip addr show dev eth0

# Add / remove an address
ip addr add 192.168.1.10/24 dev eth0
ip addr del 192.168.1.10/24 dev eth0

# Add IPv6 address
ip addr add 2001:db8::1/64 dev eth0

# Flush all addresses on an interface
ip addr flush dev eth0

# Show only IPv4 or IPv6
ip -4 addr show
ip -6 addr show

# Show the main routing table
ip route show
ip route show table all   # all routing tables

# Which route would be used for a destination?
ip route get 8.8.8.8
ip route get 192.168.1.1

# Add routes
ip route add 10.0.0.0/8 via 192.168.1.1
ip route add 10.0.0.0/8 dev eth0           # on-link route
ip route add default via 192.168.1.1       # default gateway

# Delete a route
ip route del 10.0.0.0/8

# Add a blackhole / unreachable route
ip route add blackhole 203.0.113.0/24
ip route add unreachable 203.0.113.0/24

# Flush routing cache (older kernels)
ip route flush cache

# Show ARP/NDP table
ip neigh show
ip -4 neigh show          # IPv4 only
ip neigh show dev eth0

# Add a static ARP entry
ip neigh add 192.168.1.5 lladdr aa:bb:cc:dd:ee:ff dev eth0 nud permanent

# Delete an entry
ip neigh del 192.168.1.5 dev eth0

# Flush stale entries
ip neigh flush dev eth0

# Show routing policy rules
ip rule show

# Route traffic from 10.0.0.0/24 via table 100
ip rule add from 10.0.0.0/24 table 100

# Route traffic marked with 0x1 via table 200
ip rule add fwmark 0x1 table 200

# Add default route in table 100
ip route add default via 192.168.2.1 table 100

# Delete a rule
ip rule del from 10.0.0.0/24 table 100

# List all rules with line numbers and packet counts
iptables -L -v -n --line-numbers

# Show a specific chain
iptables -L INPUT -v -n --line-numbers

# Show NAT table
iptables -t nat -L -v -n

# Show all tables
iptables -t filter -L -n
iptables -t nat    -L -n
iptables -t mangle -L -n
iptables -t raw    -L -n

# Allow established/related connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow SSH from a specific subnet
iptables -A INPUT -p tcp -s 10.0.0.0/8 --dport 22 -j ACCEPT

# Drop all other inbound traffic
iptables -A INPUT -j DROP

# Allow traffic on loopback
iptables -A INPUT -i lo -j ACCEPT

# Rate-limit new connections (e.g. SSH brute-force protection)
iptables -A INPUT -p tcp --dport 22 -m state --state NEW \
  -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW \
  -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP

# MASQUERADE (SNAT for dynamic IP — e.g. internet sharing)
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# DNAT — port-forward 8080 → internal host port 80
iptables -t nat -A PREROUTING -p tcp --dport 8080 \
  -j DNAT --to-destination 192.168.1.10:80

# Delete rule by line number
iptables -D INPUT 3

# Flush all rules in a chain
iptables -F INPUT

# Set default policy
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Save / restore (Debian/Ubuntu)
iptables-save  > /etc/iptables/rules.v4
iptables-restore < /etc/iptables/rules.v4

# Save (RHEL/CentOS with iptables-services)
service iptables save

# List all ruleset
nft list ruleset

# List a specific table
nft list table inet filter

# Add a table and basic chains
nft add table inet filter
nft add chain inet filter input  \
  { type filter hook input priority 0 \; policy drop \; }
nft add chain inet filter output \
  { type filter hook output priority 0 \; policy accept \; }

# Allow established connections
nft add rule inet filter input ct state established,related accept

# Allow SSH
nft add rule inet filter input tcp dport 22 accept

# Allow loopback
nft add rule inet filter input iifname lo accept

# NAT masquerade
nft add table ip nat
nft add chain ip nat postrouting \
  { type nat hook postrouting priority 100 \; }
nft add rule ip nat postrouting oifname "eth0" masquerade

# Load ruleset from file
nft -f /etc/nftables.conf

# Delete table
nft delete table inet filter

# All TCP sockets with process info
ss -tlnp            # listening TCP
ss -tnp             # established TCP
ss -tanp            # all TCP

# UDP
ss -ulnp            # listening UDP

# Unix domain sockets
ss -xlnp

# Filter by port
ss -tnp sport = :80
ss -tnp dport = :443

# Filter by state
ss state ESTABLISHED
ss state TIME-WAIT
ss state FIN-WAIT-1

# Filter by destination address
ss -tn dst 10.0.0.1
ss -tn dst 10.0.0.0/8

# Show socket memory usage
ss -tnm

# Show timer information
ss -tno

# Listening TCP/UDP ports with process info
netstat -tlnp
netstat -ulnp

# All TCP connections
netstat -tanp

# Routing table
netstat -rn

# Network interface statistics
netstat -i

# Continuous refresh every 2s
netstat -c -tanp

# Capture on interface eth0
tcpdump -i eth0

# Capture on all interfaces
tcpdump -i any

# Don't resolve hostnames/ports (-n), show timestamps (-tttt)
tcpdump -i eth0 -n -tttt

# Capture only 100 packets
tcpdump -i eth0 -c 100

# Save to pcap file
tcpdump -i eth0 -w /tmp/capture.pcap

# Read from pcap file
tcpdump -r /tmp/capture.pcap

# Rotate files: 10MB each, keep 5
tcpdump -i eth0 -w /tmp/cap.pcap -C 10 -W 5

# TCP port 443
tcpdump -i eth0 tcp port 443

# Traffic to/from a host
tcpdump -i eth0 host 10.0.0.1

# Source host and destination port
tcpdump -i eth0 src host 10.0.0.1 and dst port 80

# ICMP only
tcpdump -i eth0 icmp

# Exclude SSH (avoid capturing your own session)
tcpdump -i eth0 not port 22

# HTTP GET requests (payload inspection)
tcpdump -i eth0 -A -s0 'tcp port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420)'

# SYN packets only (new connections)
tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0'

# DNS queries
tcpdump -i eth0 port 53

# Capture on eth0, decode protocols
tshark -i eth0

# Read pcap and decode HTTP
tshark -r capture.pcap -Y http

# Show only HTTP request URIs
tshark -r capture.pcap -Y http.request -T fields \
  -e ip.src -e http.request.method -e http.request.uri

# DNS query names
tshark -i eth0 -Y dns.qry.name -T fields -e dns.qry.name

# Export as JSON
tshark -r capture.pcap -T json > out.json

# Follow TCP stream
tshark -r capture.pcap -z follow,tcp,ascii,0

# A record lookup (default)
dig example.com

# Specific record types
dig example.com MX
dig example.com AAAA
dig example.com TXT
dig example.com NS
dig example.com SOA
dig example.com CNAME

# Short output (just the answer)
dig +short example.com
dig +short example.com MX

# Query a specific DNS server
dig @8.8.8.8 example.com
dig @1.1.1.1 example.com AAAA

# Reverse lookup (PTR)
dig -x 8.8.8.8

# Trace the full delegation chain
dig +trace example.com

# Show DNSSEC records
dig +dnssec example.com

# Disable recursion (query authoritative only)
dig +norecurse @ns1.example.com example.com

# Bulk lookup from file
dig -f domains.txt +short

# Show resolver status and configured DNS servers
resolvectl status

# Lookup a name
resolvectl query example.com

# Reverse lookup
resolvectl query 8.8.8.8

# Show per-interface DNS configuration
resolvectl dns

# Show DNS search domains
resolvectl domain

# Show resolver cache statistics
resolvectl statistics

# Flush the DNS cache
resolvectl flush-caches

# Override DNS for an interface temporarily
resolvectl dns eth0 8.8.8.8 8.8.4.4

# host
host example.com
host example.com 8.8.8.8     # query specific server
host -t MX example.com
host 8.8.8.8                   # reverse lookup

# nslookup
nslookup example.com
nslookup -type=MX example.com
nslookup example.com 1.1.1.1  # query specific server
nslookup 8.8.8.8               # reverse lookup

# Basic ping
ping 8.8.8.8
ping example.com

# Send 5 packets then stop
ping -c 5 example.com

# Set packet interval (0.2s = flood-ish)
ping -i 0.2 example.com

# Set payload size (default 56 bytes)
ping -s 1400 example.com       # useful for MTU testing

# Flood ping (requires root)
ping -f example.com

# Set TTL
ping -t 5 example.com

# IPv6
ping6 2001:4860:4860::8888
ping -6 example.com

# Basic traceroute
traceroute example.com

# Use ICMP instead of UDP probes
traceroute -I example.com

# Use TCP probes on port 80 (bypasses UDP filters)
traceroute -T -p 80 example.com

# No reverse DNS lookups (faster)
traceroute -n example.com

# Set max TTL (hops)
traceroute -m 20 example.com

# Interactive live view
mtr example.com

# Non-interactive report mode (100 cycles)
mtr --report --report-cycles 100 example.com

# No DNS resolution
mtr -n example.com

# Use TCP probes on port 443
mtr --tcp --port 443 example.com

# Test if a TCP port is open
nc -zv 10.0.0.1 80
nc -zv 10.0.0.1 8080-8090      # scan a port range

# Test UDP port
nc -zuv 10.0.0.1 53

# Connect and send data interactively
nc 10.0.0.1 9000

# Simple HTTP request
echo -e "GET / HTTP/1.0\r\nHost: example.com\r\n\r\n" | nc example.com 80

# Listen on a port (simple server)
nc -lp 9000

# Transfer a file
# Receiver:
nc -lp 9000 > received.tar.gz
# Sender:
nc 10.0.0.2 9000 < file.tar.gz

# With timeout (exit if no connection in 3s)
nc -zv -w 3 10.0.0.1 443

# Basic GET
curl https://example.com

# Show response headers only
curl -I https://example.com

# Show headers + body
curl -v https://example.com

# POST JSON
curl -X POST https://api.example.com/data \
  -H 'Content-Type: application/json' \
  -d '{"key":"value"}'

# Follow redirects
curl -L https://example.com

# Save response to file
curl -o output.html https://example.com

# Download with original filename
curl -O https://example.com/file.tar.gz

# Set custom header
curl -H 'Authorization: Bearer TOKEN' https://api.example.com

# Test with specific DNS / IP (override DNS)
curl --resolve 'example.com:443:93.184.216.34' https://example.com

# Ignore TLS cert errors (testing only)
curl -k https://self-signed.example.com

# Set timeout
curl --connect-timeout 5 --max-time 30 https://example.com

# Show timing breakdown
curl -o /dev/null -s -w \
  "dns:%{time_namelookup}  conn:%{time_connect}  tls:%{time_appconnect}  ttfb:%{time_starttransfer}  total:%{time_total}\n" \
  https://example.com

# Scan a single host (top 1000 ports)
nmap 10.0.0.1

# Scan a subnet
nmap 10.0.0.0/24

# Scan specific ports
nmap -p 22,80,443 10.0.0.1
nmap -p 1-65535 10.0.0.1          # all ports

# Service version detection
nmap -sV 10.0.0.1

# OS detection (requires root)
nmap -O 10.0.0.1

# Aggressive scan (OS + version + scripts + traceroute)
nmap -A 10.0.0.1

# Ping scan — discover live hosts, no port scan
nmap -sn 10.0.0.0/24

# TCP SYN scan (stealth, requires root)
nmap -sS 10.0.0.1

# UDP scan
nmap -sU -p 53,161,500 10.0.0.1

# Save output
nmap -oN scan.txt 10.0.0.1
nmap -oX scan.xml 10.0.0.1

# Show link speed, duplex, auto-negotiation
ethtool eth0

# Show driver info
ethtool -i eth0

# Show adapter statistics
ethtool -S eth0

# Show offload settings (TSO, GSO, GRO, etc.)
ethtool -k eth0

# Disable/enable an offload
ethtool -K eth0 tso off
ethtool -K eth0 gro on

# Show ring buffer sizes
ethtool -g eth0

# Set ring buffer sizes (reduce drops under load)
ethtool -G eth0 rx 4096 tx 4096

# Show pause frame settings
ethtool -a eth0

# Force link speed (avoid if possible — prefer auto-negotiation)
ethtool -s eth0 speed 1000 duplex full autoneg off

# Flash the NIC LED to identify the port
ethtool -p eth0 10           # blink for 10 seconds

# Show all wireless devices
iw dev

# Show link status (signal, bitrate, BSSID)
iw dev wlan0 link

# Scan for access points
iw dev wlan0 scan

# Show station statistics (for AP mode)
iw dev wlan0 station dump

# Show supported capabilities
iw phy phy0 info

# Set TX power
iw dev wlan0 set txpower fixed 2000  # in mBm (100 = 1 dBm)

# Create a monitor interface
iw dev wlan0 interface add mon0 type monitor
ip link set mon0 up

# List namespaces
ip netns list

# Create / delete a namespace
ip netns add testns
ip netns del testns

# Run a command in a namespace
ip netns exec testns ip addr show
ip netns exec testns bash          # enter a shell

# Connect two namespaces with a veth pair
ip link add veth0 type veth peer name veth1
ip link set veth1 netns testns

ip addr add 192.168.10.1/24 dev veth0
ip netns exec testns ip addr add 192.168.10.2/24 dev veth1

ip link set veth0 up
ip netns exec testns ip link set veth1 up
ip netns exec testns ip link set lo up

# Test connectivity
ping 192.168.10.2
ip netns exec testns ping 192.168.10.1

# 1. Is the interface up?
ip -br link show

# 2. Do we have a route?
ip route get TARGET_IP

# 3. Is the gateway reachable?
ping GW_IP

# 4. Check ARP for the gateway
ip neigh show

# 5. Test TCP connectivity (ICMP may be filtered)
nc -zv TARGET_IP 443

# 6. Trace the path
mtr --tcp --port 443 TARGET_IP

# 7. Capture to see what's happening
tcpdump -i eth0 -n host TARGET_IP

# 1. Is the process actually listening?
ss -tlnp | grep :PORT

# 2. Is it listening on 0.0.0.0 or just 127.0.0.1?
ss -tlnp | grep :PORT             # 127.0.0.1 = only local

# 3. Is a firewall blocking it?
iptables -L INPUT -v -n | grep DROP
nft list ruleset | grep drop

# 4. Test from the host itself
nc -zv 127.0.0.1 PORT

# 5. Watch what arrives (before firewall)
tcpdump -i eth0 tcp port PORT

# 1. Which resolver is being used?
cat /etc/resolv.conf
resolvectl status

# 2. Query the resolver directly
dig @127.0.0.53 example.com     # systemd-resolved stub
dig @8.8.8.8 example.com

# 3. Trace the delegation
dig +trace example.com

# 4. Flush stale cache
resolvectl flush-caches

# Continuous path quality test
mtr --report-cycles 100 TARGET

# Check interface errors / drops
ip -s link show eth0
ethtool -S eth0 | grep -i drop

# Check ring buffer drops
ethtool -g eth0
ethtool -S eth0 | grep rx_missed

# Check socket receive buffer drops
ss -s
netstat -s | grep overrun