Network on Lead DevOps

ip: Network Setup and Diagnostics in CLI

Mon, 07 Sep 2026 00:00:00 +0000

When ifconfig returns nothing and configuring a route requires a separate command, that’s not a system bug. It’s iproute2 — the package that replaced net-tools in modern Linux distributions. The ip utility from iproute2 is the standard interface for managing the Linux network stack. It covers interfaces, addresses, routes, ARP cache, routing policies, and namespace isolation.

Why iproute2 replaced net-tools

net-tools (ifconfig, route, arp, netstat, nameif) originated in BSD and migrated to Linux in the 1990s. By the 2000s it became clear: they cannot handle VLAN, IPsec, QoS, multicast routing, or Policy Routing. Each task required a separate command with unrelated syntax.

nslookup and drill: DNS resolution in terminal

Mon, 07 Sep 2026 00:00:00 +0000

The server won’t resolve a domain, but pings fly through. No familiar dig at hand — the BIOS is already loading a minimal busybox. Or on a host without bind-tools. nslookup and drill fill this gap: the first one is built into almost everything, the second gives more context when debugging.

nslookup: interactive and one-liner modes

nslookup ships with bind-utils and isc-dhcp-client. It works in two modes.

ethtool: network interface diagnostics and tuning

Fri, 04 Sep 2026 00:00:00 +0000

Network issues hide well — interface is up, IP is assigned, iptables is quiet, yet packet loss or micro-freezes only surface under load. ethtool gives direct access to hardware state, driver behavior, and offload mechanisms that neither ip nor netstat expose.

Basic Output: Link State

Installation is straightforward:

# RHEL/Alma/Rocky
sudo dnf install ethtool -y

# Debian/Ubuntu
sudo apt install ethtool

Running ethtool without flags prints a summary:

ss: socket statistics instead of deprecated netstat

Thu, 03 Sep 2026 00:00:00 +0000

When netstat hangs on a server with tens of thousands of connections, it’s time to switch to ss. Part of the iproute2 package, ss queries the kernel directly via netlink instead of parsing /proc/net/*. The result is instant output with minimal overhead.

Why switch from netstat

netstat from net-tools relies on a deprecated approach: it reads from /proc/net/tcp, /proc/net/unix and converts numeric IDs to symbolic names. On a server with active connections, this takes seconds and spikes CPU usage.

tcpdump and tshark: Packet Capture in CLI

Thu, 03 Sep 2026 00:00:00 +0000

When debugging network issues in Linux infrastructure, ping and curl are not enough. Sometimes you need to see what is actually traveling over the wire. tcpdump is the standard tool for capturing packets from the CLI. tshark is its sibling from the Wireshark suite, convenient for scripting.

Quick Start with tcpdump

Check that packets are reaching the host:

tcpdump -i eth0 host 10.0.0.5

The utility puts the interface into promiscuous mode and prints one line per packet passing through. By default it works with the first interface it finds, but specifying explicitly is better.

ngrep: grep for Network Packets in Real Time

Wed, 02 Sep 2026 00:00:00 +0000

Ngrep applies grep-style pattern matching to network packets. When you need to see exactly what two services are exchanging over the wire and tcpdump drowns you in noise, ngrep isolates the payload content you care about.

Installation

Ngrep ships in the standard repositories of most distributions.

# Debian/Ubuntu
apt install ngrep

# RHEL/CentOS/Alma
yum install ngrep

# macOS
brew install ngrep

Running ngrep requires root privileges or the CAP_NET_RAW and CAP_NET_ADMIN capabilities.

Squid: Internet Forwarding to Remote VM

Tue, 01 Sep 2026 00:00:00 +0000

Your VM in the cloud has no public IP or internet access is blocked via NAT, but the deployment needs wget/curl from inside. Squid on an intermediate host with a decent uplink solves this in ten minutes.

Why This Is Needed

I forward internet through Squid when a VM sits in an isolated network segment. An intermediate host with a public IP and network access becomes the proxy server. The application on the remote machine routes traffic through the tunnel.