Linux networking commands cheat sheet

List every interface with its state and IP addresses in a short table.

ip objects can be abbreviated: a for address, r for route, n for neigh.

List interfaces with their link state and MAC address.

Show link details plus RX and TX packet, error and drop counters.

Bring an interface up.

Take an interface down.

Warning: Drops all traffic on that interface; running it on the interface you are connected through cuts off your SSH session.

Change the MTU of an interface.

Add an IP address to an interface.

Remove one IP address from an interface.

Warning: Removing the address you are connected to drops your session.

Remove all IP addresses from an interface.

Warning: Removes every matching address at once with no undo. Without scope global it also removes IPv6 link-local addresses.

Show the main routing table.

-6 shows IPv6 routes.

Add a default route through a gateway.

Add a static route to a network.

Use ip route replace to add or change a route in one step. Add metric <n> to set the preference; lower wins.

Remove a route.

Deleting the default route on a remote server cuts off access from other networks.

Show the route, source address and interface the kernel would use for a destination.

No packet is sent.

Show the ARP (IPv4) and NDP (IPv6) neighbour table with entry states.

States include REACHABLE, STALE, FAILED and PERMANENT.

Clear neighbour (ARP) entries on an interface so they are learned again.

List listening TCP and UDP sockets with port numbers and the owning process.

-p needs root to show processes owned by other users.

Print a summary of socket counts by type and state.

List established TCP connections with numeric addresses and ports.

List TCP sockets to or from a given port.

Show the overall status of NetworkManager and connectivity.

List devices with their type, state and active connection profile.

Show details of a device, including addresses, gateway and DNS.

List connection profiles stored on the system.

--active lists only profiles in use. Add a profile name to see all its settings.

Activate a connection profile, applying its saved settings.

Deactivate a connection profile.

Warning: Takes the interface offline; over SSH this disconnects you if it is the profile you are using.

Give a profile a static IPv4 address, gateway and DNS server.

Saved to the profile only; run nmcli connection up <profile> to apply. Set ipv4.method auto to go back to DHCP.

Append a DNS server to a profile without replacing the existing ones.

Use -ipv4.dns to remove one.

Create a new Ethernet connection profile (DHCP unless you set ipv4.method).

Query DNS for a name; with no type it looks up the A record.

Print only the answer values.

Send the query to a specific DNS server instead of the system resolver.

Do a reverse (PTR) lookup for an IPv4 or IPv6 address.

Follow the delegation from the root servers down and show the answer from each server.

Show the global and per-link DNS servers and search domains used by systemd-resolved.

Resolve a name or address through systemd-resolved, as applications see it.

Flush the systemd-resolved DNS cache.

Send a set number of ICMP echo requests and stop.

-4 or -6 forces the IP version; -I <interface> sets the source interface or address.

Test path MTU by sending packets with Don't Fragment set.

1472 bytes of data plus 28 bytes of headers is a 1500-byte IPv4 packet. If it fails, lower the size until it passes.

Show each hop to a destination without resolving names.

Uses UDP probes by default. -I uses ICMP echo; -T -p 443 uses TCP SYN to port 443 and needs root.

Trace the path and discover the path MTU, without root.

Run several traceroute cycles and print per-hop loss and latency statistics.

Install the mtr package (mtr-tiny on minimal Debian/Ubuntu). --tcp --port 443 probes with TCP instead of ICMP.

List the interfaces tcpdump can capture on.

Capture on an interface without converting addresses and port numbers to names.

any captures on all interfaces (not in promiscuous mode). Add -c <count> to stop after that many packets.

Capture only traffic to or from one host.

Capture with a combined filter on host, port or protocol.

Quote filters that contain spaces or parentheses.

Write raw packets to a file for Wireshark instead of printing them.

Read and print packets from a saved capture file.

Print the whole firewall ruleset.

The output can be loaded again with nft -f.

List one table with each rule's handle number.

Create a table.

The inet family covers IPv4 and IPv6 together.

Create a base chain that filters incoming packets and drops anything not accepted.

Warning: With policy drop, incoming traffic including SSH is blocked at once until accept rules exist. On a remote server load the chain and its accept rules together from a file with nft -f.

Allow return traffic for connections that are already established.

Allow incoming SSH.

Use a set for several ports: tcp dport { 22, 443 } accept.

Remove one rule by its handle number.

Warning: The rule is removed immediately. Find the handle with nft -a list table.

Load a ruleset from a file.

nft -c -f <file> checks the file without applying it.

Remove all tables, chains and rules.

Warning: Leaves no packet filtering at all, and anything not saved is lost. Save first with nft list ruleset > <file>.