Network Troubleshooting Cheat Sheet

Practical network diagnostic toolkit: ping, traceroute, netstat/ss, tcpdump packet capture, nmap scanning, and systematic troubleshooting methodology.

Last Updated: May 1, 2025

Connectivity Testing

ping -c 4 host

Send 4 ICMP echo requests — test basic reachability

ping -i 0.2 host

Flood ping with 0.2s interval (careful!)

mtr host

My Traceroute — continuous ping + traceroute, best diagnostic

traceroute host

Trace packet path with TTL increments (UDP by default)

traceroute -T host

Use TCP SYN instead of UDP (gets through firewalls)

tracepath host

Like traceroute but discovers MTU along the path

arp -a

Show ARP table (IP → MAC address mappings)

ip neigh

Modern replacement for arp — show neighbor table

Port & Connection Diagnostics

ss -tlnp

List all listening TCP ports with process names

ss -tan

Show all TCP connections (listening + established)

ss -s

Summary statistics: total sockets by type/state

netstat -tlnp

Legacy: show listening TCP ports (ss is faster)

netstat -i

Network interface statistics (errors, drops)

lsof -i :80

List processes using port 80

nmap -p 1-1000 host

Scan first 1000 ports on a host

nmap -sV host

Service/version detection on open ports

Packet Capture (tcpdump)

tcpdump -i eth0

Capture all traffic on interface eth0

tcpdump -i any port 80

Capture HTTP traffic on any interface

tcpdump -i eth0 host 192.168.1.100

Only traffic to/from specific host

tcpdump -i eth0 -w capture.pcap

Write packets to .pcap file for Wireshark

tcpdump -r capture.pcap

Read packets from capture file

tcpdump -i eth0 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0'

TCP SYN/FIN flags only

tcpdump -i eth0 -A port 80

Show HTTP payload in ASCII

DNS & HTTP Diagnostics

dig +trace example.com

Trace full DNS delegation from root

nslookup example.com

Simple DNS lookup (interactive mode available)

host example.com

Quick DNS lookup with concise output

curl -v https://example.com 2>&1 | grep -E '^(> |< )'

Show HTTP request/response headers only

nc -zv host 443

Test if TCP port is open (netcat zero-I/O mode)

tcptraceroute host 80

Trace path to a specific TCP port

Pro Tip: Troubleshoot from bottom up: Physical → Data Link (ARP) → Network (ping/IP) → Transport (port check) → Application. Also: mtr combines ping + traceroute in one tool — use it!