6.7 Networking Commands
| Command | Purpose | Example |
|---|---|---|
ip addr (ip a) |
Interfaces and IP addresses | ip -4 a |
ip route |
Routing table / default gateway | ip r |
ss -tulnp |
Listening TCP/UDP ports with process | sudo ss -tlnp |
netstat -tulnp |
Older equivalent of ss (package net-tools) |
sudo netstat -tlnp |
ping |
Reachability (ICMP) | ping -c 4 google.com |
curl |
HTTP client — test websites/APIs | curl -I http://localhost |
wget |
Download files | wget https://wordpress.org/latest.tar.gz |
dig / nslookup |
DNS lookup (package bind-utils or dnsutils) |
dig +short example.com |
traceroute / tracepath |
Route to a host | tracepath google.com |
nc (netcat) |
Test if a TCP port is open | nc -zv 10.0.1.25 3306 |
hostnamectl |
Show / set hostname | sudo hostnamectl set-hostname web01 |
sudo ss -tlnp # which programs listen on which ports?
sudo ss -tlnp | grep ':80 ' # is anything on port 80?
curl -I http://localhost # only response headers (HTTP status)
curl -s http://localhost:3000/api/health
curl -o page.html https://example.com
wget -q -O - https://checkip.amazonaws.com # print public IP
ping -c 3 8.8.8.8
Reading ss -tlnp output
0.0.0.0:80 or *:80 → listening on all interfaces (reachable from outside if the security group allows). 127.0.0.1:3000 → only reachable from the server itself (good for apps behind a reverse proxy).
ping to EC2 fails?
Security groups block ICMP by default. A failed ping does not mean the server is down — test with curl or nc on the actual port, or allow All ICMP – IPv4 from your IP for testing.
Installing missing network tools
# Ubuntu
sudo apt install -y net-tools dnsutils traceroute netcat-openbsd
# Amazon Linux 2023 / CentOS Stream 9
sudo yum install -y net-tools bind-utils traceroute nmap-ncat
Why this matters for security
ss -tulnp is your local "Nmap from the inside": every listening socket is a potential entry point. A service on 0.0.0.0 is exposed; the same service on 127.0.0.1 is reachable only locally. Compare this list with what Nmap sees from outside (Part 10).
Ravindra Bagale's Tip
ping fail zala ki khup students "server down" mhantat. EC2 security group ICMP default block karto! Port test karayla nc -zv IP 80 kiwa curl -I vapra. Ping ne fakt ICMP kalte, service nahi.
Practice task
Find your instance's private IP, default gateway, DNS resolver (cat /etc/resolv.conf) and all listening ports. Test port 22 of your own instance from your laptop with nc -zv.