# Show NIC ring buffer sizes and current settings
ethtool -g eth0

# Show NIC offload settings (GRO, GSO, TSO, …)
ethtool -k eth0

# Show interrupt coalescing settings
ethtool -c eth0

# Show per-queue NIC stats (drops, errors)
ethtool -S eth0

# Show softirq counters per CPU
cat /proc/softirqs | grep NET

# Attach XDP program (native mode)
ip link set dev eth0 xdp obj xdp_prog.o sec xdp

# Attach in generic (SKB) mode — any driver
ip link set dev eth0 xdpgeneric obj xdp_prog.o sec xdp

# Remove XDP program
ip link set dev eth0 xdp off

# Show XDP info
ip link show dev eth0 | grep xdp

# Using bpftool
bpftool net show dev eth0
bpftool prog list

// Drop all UDP packets, pass everything else
#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/udp.h>

SEC("xdp")
int xdp_drop_udp(struct xdp_md *ctx) {
    void *data     = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;

    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end) return XDP_DROP;
    if (eth->h_proto != htons(ETH_P_IP)) return XDP_PASS;

    struct iphdr *ip = (void *)(eth + 1);
    if ((void *)(ip + 1) > data_end) return XDP_DROP;
    if (ip->protocol == IPPROTO_UDP)   return XDP_DROP;

    return XDP_PASS;
}

# Show qdiscs on interface
tc qdisc show dev eth0

# Add 100ms delay + 10ms jitter for testing (netem)
tc qdisc add dev eth0 root netem delay 100ms 10ms

# Rate-limit to 100 Mbps with HTB
tc qdisc add dev eth0 root handle 1: htb default 10
tc class add dev eth0 parent 1: classid 1:10 htb rate 100mbit burst 15k

# Attach eBPF program to TC ingress
tc qdisc add dev eth0 clsact
tc filter add dev eth0 ingress bpf da obj tc_prog.o sec tc

# Show TC filters
tc filter show dev eth0 ingress
tc filter show dev eth0 egress

# List all rules with packet/byte counters
iptables -L -n -v

# List rules in a specific table
iptables -t nat -L -n -v

# Drop all traffic from an IP
iptables -A INPUT -s 1.2.3.4 -j DROP

# Allow established/related (stateful firewall)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Port forwarding: redirect :8080 → 192.168.1.10:80 (DNAT)
iptables -t nat -A PREROUTING -p tcp --dport 8080 \
         -j DNAT --to-destination 192.168.1.10:80

# Masquerade for NAT gateway
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Trace a packet through all chains (use TRACE in raw table)
iptables -t raw -A PREROUTING -s 1.2.3.4 -j TRACE
modprobe nf_log_ipv4
dmesg | grep TRACE

# List all tracked connections
conntrack -L

# Watch the conntrack table in real time
conntrack -E

# Show conntrack table statistics
conntrack -S

# Show current conntrack table size and max
cat /proc/sys/net/netfilter/nf_conntrack_count
cat /proc/sys/net/netfilter/nf_conntrack_max

# Flush the conntrack table (use with care!)
conntrack -F

# Delete a specific entry
conntrack -D -s 1.2.3.4 -d 5.6.7.8

# Show routing table
ip route show
ip route show table all

# Which route/interface would be used for a destination?
ip route get 8.8.8.8

# Show ARP / neighbor cache
ip neigh show

# Show policy routing rules
ip rule show

# Show interface addresses
ip addr show

# Trace route to a host
traceroute 8.8.8.8
mtr --report 8.8.8.8

# Show available congestion control algorithms
cat /proc/sys/net/ipv4/tcp_available_congestion_control

# Show currently active algorithm
cat /proc/sys/net/ipv4/tcp_congestion_control

# Switch to BBR (Bottleneck Bandwidth and RTT)
sysctl -w net.ipv4.tcp_congestion_control=bbr

# Show TCP stats
ss -tin
nstat -az | grep Tcp

# Show all TCP sockets with timer and process info
ss -tinp

# Show UDP sockets
ss -unp

# Show listen sockets with backlog
ss -tlnp

# Show socket memory usage
ss -m

# Show per-socket stats including retransmits
ss -tin dst 10.0.0.1

# Count XDP actions per second
bpftrace -e 'kprobe:bpf_prog_run_xdp { @[retval] = count(); }'

# Trace XDP drops with stack
bpftrace -e 'kprobe:xdp_do_generic_redirect { @drops = count(); }'

# Show per-interface XDP stats
ip -s link show dev eth0

// Tag all TCP packets with fwmark=1 on ingress
#include <linux/bpf.h>
#include <linux/pkt_cls.h>
#include <linux/ip.h>
#include <linux/tcp.h>

SEC("tc")
int tc_mark_tcp(struct __sk_buff *skb) {
    void *data     = (void *)(long)skb->data;
    void *data_end = (void *)(long)skb->data_end;

    struct iphdr *ip = data + 14; /* skip Ethernet header */
    if ((void *)(ip + 1) > data_end) return TC_ACT_OK;
    if (ip->protocol == IPPROTO_TCP)
        skb->mark = 1;

    return TC_ACT_OK;
}

# Trace new TCP connections with source/dest
bpftrace -e 'kprobe:tcp_connect {
    $sk = (struct sock *)arg0;
    printf("connect: %s → %s\n",
        ntop($sk->__sk_common.skc_rcv_saddr),
        ntop($sk->__sk_common.skc_daddr));
}'

# Trace TCP retransmits
bpftrace -e 'kprobe:tcp_retransmit_skb { @retransmits[comm] = count(); }'

# Trace socket accept latency
bpftrace -e 'kprobe:inet_csk_accept { @start[tid] = nsecs; }
             kretprobe:inet_csk_accept /retval/ {
                 @latency_us = hist((nsecs - @start[tid]) / 1000); }'

# Capture with full header decode
tcpdump -i eth0 -v -nn

# Show raw hex + ASCII
tcpdump -i eth0 -XX -nn

# Filter TCP SYN packets
tcpdump -i eth0 'tcp[tcpflags] & tcp-syn != 0'

# Capture to file for Wireshark
tcpdump -i eth0 -w capture.pcap

# Show ICMP only
tcpdump -i eth0 icmp -nn

# Socket buffer sizes (bytes)
sysctl -w net.core.rmem_max=16777216
sysctl -w net.core.wmem_max=16777216
sysctl -w net.ipv4.tcp_rmem="4096 87380 16777216"
sysctl -w net.ipv4.tcp_wmem="4096 65536 16777216"

# Increase connection capacity
sysctl -w net.core.somaxconn=65535
sysctl -w net.ipv4.tcp_max_syn_backlog=65535
sysctl -w net.ipv4.ip_local_port_range="1024 65535"

# Increase conntrack table size
sysctl -w net.netfilter.nf_conntrack_max=2097152

# Enable TCP BBR (better congestion control)
sysctl -w net.ipv4.tcp_congestion_control=bbr
sysctl -w net.core.default_qdisc=fq

# Reduce TIME_WAIT duration
sysctl -w net.ipv4.tcp_fin_timeout=15
sysctl -w net.ipv4.tcp_tw_reuse=1

# NAPI polling budget
sysctl -w net.core.netdev_budget=600
sysctl -w net.core.netdev_budget_usecs=8000