OneLinersCommand workbench
Cheatsheets

Incident guide · Network & DNS

Linux network and DNS troubleshooting cheat sheet

Trace interface, route, neighbor, resolver, DNSSEC, packet, path, TLS, and HTTP evidence from the host outward.
50explained commands2practical sections100%concrete examples
25

Host network state

Confirm link state, addresses, routing, neighbors, and resolver configuration.

Show Linux network interfaces and addressesip -brief addressRead-only
Resolve the kernel route to an addressip route get <address>Read-only
Show failed and incomplete neighbor entriesip neigh show nud failed,incompleteRead-only
Show per-link resolver configurationresolvectl statusRead-only
List listening TCP ports and their processeslsof -iTCP -sTCP:LISTEN -n -PRead-only
List listening Linux sockets with process detailsss -lntupRead-only
Fetch only the HTTP response headerscurl -I <url>Read-only
Resolve a hostname to its IP addressdig +short <domain>Read-only
Print your current public IP addresscurl -s https://api.ipify.orgRead-only
Send four ICMP probes to a hostping -c 4 <host>Read-only
Trace the network path to a hosttraceroute <host>Read-only
Measure HTTP response timingcurl -o /dev/null -s -w 'dns=%{time_namelookup}s connect=%{time_connect}s total=%{time_total}s\n' <url>Read-only
Check whether a TCP port accepts connectionsnc -vz <host> <port>Read-only
Look up DNS records for a hosthost <domain>Read-only
Show the default network routeip route show defaultRead-only
Count established TCP connectionsss -H state established | wc -lRead-only
Check a list of URLs concurrently and print status codesxargs -P <workers> -n 1 curl -sS -o /dev/null -w '%{http_code}\t%{url_effective}\n' < <file>Read-only
Break an HTTP request into DNS, TCP, TLS, TTFB, and total timecurl -sS -o /dev/null -w 'status=%{http_code} dns=%{time_namelookup}s tcp=%{time_connect}s tls=%{time_appconnect}s ttfb=%{time_starttransfer}s total=%{time_total}s remote=%{remote_ip}\n' <url>Read-only
Trace every HTTP status and Location header in a redirect chaincurl -sS -I -L <url> | awk 'BEGIN{IGNORECASE=1} /^HTTP\// || /^location:/ {gsub("\r",""); print}'Read-only
Query the useful DNS record set for a domainfor type in A AAAA MX NS TXT CAA; do echo "--- $type ---"; dig +short <domain> $type; doneRead-only
Trace DNS delegation from the root to the authoritative answerdig +trace +nodnssec <domain>Read-only
Compare an A record across three public DNS resolversfor resolver in 1.1.1.1 8.8.8.8 9.9.9.9; do printf '%-9s ' "$resolver"; dig +short @${resolver} <domain> A | paste -sd, -; doneRead-only
Request DNSSEC validation and expose the authenticated-data flagdig +dnssec <domain> A | awk '/flags:/{print} /ANSWER SECTION:/{show=1;next} show && NF==0{exit} show{print}'Read-only
Enumerate accepted TLS ciphers and their gradesnmap --script ssl-enum-ciphers -p <port> <host>caution
25

DNS, path, TLS, and HTTP

Follow the request path and capture bounded network evidence.

Trace DNS delegation from the rootdig +trace <domain> | tail -15Read-only
Request DNSSEC validation detailsdig +dnssec <domain> A | rg 'flags:|ANSWER SECTION|RRSIG' -A3Read-only
Run a ten-cycle path quality reportmtr -rwzc 10 <host>Read-only
Print certificate subject and validity datesopenssl x509 -in <certificate> -noout -subject -issuer -datesRead-only
Show the remote IP and HTTP status for a URLcurl -sS -o /dev/null -w 'remote_ip=%{remote_ip} status=%{http_code}\n' <url>Read-only
Capture twenty DNS packets with names decodedtcpdump -ni <interface> -c 20 port 53Read-only
Rank remote IPs by established TCP connection countss -Hnt state established | awk '{print $5}' | sed -E 's/^\[?([^]]+)\]?:[0-9]+$/\1/' | sort | uniq -c | sort -nr | head -<count>Read-only
Summarize listening TCP sockets by address and owning processss -lntpH | awk '{printf "%-24s %-10s %s\n", $4, $2, $NF}' | sort -k1,1Read-only
Resolve the exact Linux route, source address, and next hop to a hostip route get <host>Read-only
Sort the neighbor table by interface and reachability stateip -j neigh show | jq -r '.[] | [.dev,.dst,(.lladdr // "-"),(.state[0] // "UNKNOWN")] | @tsv' | sortRead-only
Capture and decode twenty DNS queries and responsessudo tcpdump -ni <interface> -c <count> -vvv 'port 53'caution
Capture new TCP connection attempts without payload datasudo tcpdump -ni <interface> -c <count> 'tcp[tcpflags] & tcp-syn != 0'caution
Discover live hosts on an authorized subnet without port scanningnmap -sn <subnet>caution
Run a report-mode path quality test with loss and latency statisticsmtr --report --report-cycles <count> --wide <host>Read-only
Measure bidirectional TCP throughput against an iperf3 serveriperf3 -c <host> -p <port> --bidir --time <seconds> --format mRead-only
Inspect a process file descriptors, sockets, and deleted filessudo lsof -nP -p <process-id> | head -<count>caution
Send a zero-I/O UDP port probe with netcatnc -vzu -w 3 <host> <port>Read-only
Send a raw HTTP HEAD request through netcatprintf 'HEAD / HTTP/1.0\r\nHost: %s\r\n\r\n' <host> | nc -w 5 <host> <port>Read-only
List listening TCP and UDP ports with owning processessudo netstat -tulpnRead-only
List established TCP connections without DNS lookupsnetstat -tn | awk '$6=="ESTABLISHED"'Read-only
Show the kernel routing table with netstatnetstat -rnRead-only
Show network interface packet and error counters with netstatnetstat -iRead-only
Trace network system calls from a running Linux processsudo strace -f -p <process-id> -e trace=%network -s 256caution
Show only failed network system calls from a curl requeststrace -f -e trace=%network -e status=failed curl <url>caution