Linux Commands for Network Engineers
Modern networking runs on Linux — network OSes, automation servers, cloud instances and SOC tooling. These are the 20 commands network engineers actually use daily, from ip and ss to dig, tcpdump and mtr.
The essential 20
| Command | What it does |
|---|---|
ip addr | Show interfaces and IP addresses (replaces ifconfig) |
ip route | Show the routing table (replaces route -n) |
ip neigh | Show the ARP/neighbour table (replaces arp -a) |
ping / ping6 | Test reachability (ICMP echo) |
traceroute | Show the path packets take, hop by hop |
mtr | Live combined ping + traceroute — per-hop loss and latency |
ss -tuln | List listening TCP/UDP sockets (replaces netstat) |
dig example.com | Query DNS in detail — records, TTLs, which server answered |
nslookup | Quick DNS lookup (simpler than dig) |
curl -v https://site | Test HTTP/HTTPS from the CLI, see headers and TLS |
tcpdump -i eth0 | Capture packets on an interface — the CLI Wireshark |
ethtool eth0 | Show link speed, duplex and NIC details |
nmcli | Manage NetworkManager connections (desktop/server Wi-Fi, IPs) |
hostname -I | Show the host's IP addresses quickly |
ssh / scp | Remote login and secure file copy — daily bread |
nc -zv host 443 | Test if a TCP port answers (netcat) |
systemctl status sshd | Check whether a service is running |
journalctl -u sshd | Read a service's logs |
cat /etc/resolv.conf | See which DNS servers the host uses |
iptables -L / nft list ruleset | View the host firewall rules |
Note the modern replacements: ip replaces ifconfig/route/arp, and ss replaces netstat — the old commands still appear in tutorials but are deprecated on current distros.
The troubleshooting flow on Linux
The layered method maps directly to commands: ip addr (do I have an address?) → ip route (do I have a route?) → ping gateway → ping 8.8.8.8 → dig google.com (is DNS working?) → mtr (where does the path degrade?) → ss -tuln / nc -zv (is the service listening/reachable?) → tcpdump (what is actually on the wire?).
Why network engineers need Linux now
Cisco IOS-XE, automation tooling (Python, Ansible), cloud instances (AWS/Azure) and SOC platforms all assume Linux comfort. You don't need to be a sysadmin — you need these 20 commands and the confidence to read logs with journalctl.
Frequently asked questions
Which Linux commands should a network engineer know?
The core set: ip addr/route/neigh, ping, traceroute, mtr, ss, dig, nslookup, curl, tcpdump, ethtool, ssh/scp, nc, systemctl, journalctl and the resolv.conf/firewall views. These cover interface, routing, DNS, port and packet-level troubleshooting.
What replaced ifconfig and netstat?
The ip command (from iproute2) replaces ifconfig, route and arp; ss replaces netstat. The old tools are deprecated on modern distributions.
How do I check if a port is open on Linux?
Use ss -tuln to see listening sockets locally, or nc -zv host port to test a remote port from the outside.
Do I need Linux for CCNA?
The CCNA exam itself is Cisco-focused, but real jobs assume basic Linux for automation servers, cloud instances and tooling — learning these 20 commands early pays off immediately.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.