Troubleshooting Network Issues
1. Tracing Network Path
| Command | Description | Usage Example |
|---|---|---|
| traceroute | Traces the path packets take to reach a destination | traceroute google.com |
| mtr | Combines ping and traceroute for continuous monitoring | mtr google.com |
| tracepath | Traces network path without requiring root privileges | tracepath google.com |
Example: Using traceroute to diagnose network path
<pre><code>traceroute -n google.com
1 192.168.1.1 1.23ms
2 10.0.0.1 2.45ms
3 203.0.113.5 5.67ms
4 203.0.113.9 4.89ms
5 203.0.113.13 6.12ms
6 203.0.113.17 5.98ms
7 203.0.113.21 5.45ms
8 203.0.113.25 6.01ms
9 203.0.113.29 5.76ms
10 203.0.113.33 5.89ms
11 203.0.113.37 6.23ms
12 203.0.113.41 5.91ms
13 203.0.113.45 6.05ms
14 203.0.113.49 5.87ms
15 203.0.113.53 6.10ms
16 203.0.113.57 5.94ms
17 203.0.113.61 6.02ms
18 203.0.113.65 5.99ms
19 203.0.113.69 6.08ms
20 203.0.113.73 5.96ms
21 203.0.113.77 6.15ms
22 203.0.113.81 5.97ms
23 203.0.113.85 6.04ms
24 203.0.113.89 5.93ms
25 203.0.113.93 6.09ms
26 203.0.113.97 5.98ms
27 203.0.113.101 6.11ms
28 203.0.113.105 5.95ms
29 203.0.113.109 6.03ms
30 203.0.113.113 5.97ms
31 203.0.113.117 6.06ms
32 203.0.113.121 5.94ms
33 203.0.113.125 6.07ms
34 203.0.113.129 5.96ms
35 203.0.113.133 6.12ms
36 203.0.113.137 5.98ms
37 203.0.113.141 6.05ms
38 203.0.113.145 5.99ms
39 203.0.113.149 6.03ms
40 203.0.113.153 5.97ms
41 203.0.113.157 6.08ms
42 203.0.113.161 5.95ms
43 203.0.113.165 6.04ms
44 203.0.113.169 5.98ms
45 203.0.113.173 6.09ms
46 203.0.113.177 5.96ms
47 203.0.113.181 6.05ms
48 203.0.113.185 5.97ms
49 203.0.113.189 6.02ms
50 203.0.113.193 5.94ms
51 203.0.113.197 6.06ms
52 203.0.113.201 5.98ms
53 203.0.113.205 6.03ms
54 203.0.113.209 5.97ms
55 203.0.113.213 6.04ms
56 203.0.113.217 5.99ms
57 203.0.113.221 6.05ms
58 203.0.113.225 5.96ms
59 203.0.113.229 6.07ms
60 203.0.113.233 5.98ms
61 203.0.113.237 6.04ms
62 203.0.113.241 5.97ms
63 203.0.113.245 6.09ms
64 203.0.113.249 5.95ms
65 203.0.113.253 6.03ms
66 203.0.113.257 5.98ms
67 203.0.113.261 6.05ms
68 203.0.113.265 5.97ms
69 203.0.113.269 6.04ms
70 203.0.113.273 5.96ms
71 203.0.113.277 6.08ms
72 203.0.113.281 5.95ms
73 203.0.113.285 6.03ms
74 203.0.113.289 5.97ms
75 203.0.113.293 6.04ms
76 203.0.113.297 5.98ms
77 203.0.113.301 6.05ms
78 203.0.113.305 5.96ms
79 203.0.113.309 6.07ms
80 203.0.113.313 5.98ms
81 203.0.113.317 6.04ms
82 203.0.113.321 5.97ms
83 203.0.113.325 6.09ms
84 203.0.113.329 5.95ms
85 203.0.113.333 6.03ms
86 203.0.113.337 5.98ms
87 203.0.113.341 6.05ms
88 203.0.113.345 5.96ms
89 203.0.113.349 6.07ms
90 203.0.113.353 5.98ms
91 203.0.113.357 6.04ms
92 203.0.113.361 5.97ms
93 203.0.113.365 6.09ms
94 203.0.113.369 5.95ms
95 203.0.113.373 6.03ms
96 203.0.113.377 5.98ms
97 203.0.113.381 6.05ms
98 203.0.113.385 5.96ms
99 203.0.113.389 6.07ms
100 203.0.113.393 5.98ms
101 203.0.113.397 6.04ms
102 203.0.113.401 5.97ms
103 203.0.113.405 6.09ms
104 203.0.113.409 5.95ms
105 203.0.113.413 6.03ms
106 203.0.113.417 5.98ms
107 203.0.113.421 6.05ms
108 203.0.113.425 5.96ms
109 203.0.113.429 6.07ms
110 203.0.113.433 5.98ms
111 203.0.113.437 6.04ms
112 203.0.113.441 5.97ms
113 203.0.113.445 6.09ms
114 203.0.113.449 5.95ms
115 203.0.113.453 6.03ms
116 203.0.113.457 5.98ms
117 203.0.113.461 6.05ms
118 203.0.113.465 5.96ms
119 203.0.113.469 6.07ms
120 203.0.113.473 5.98ms
121 203.0.113.477 6.04ms
122 203.0.113.481 5.97ms
123 203.0.113.485 6.09ms
124 203.0.113.489 5.95ms
125 203.0.113.493 6.03ms
126 203.0.113.497 5.98ms
127 203.0.113.501 6.05ms
128 203.0.113.505 5.96ms
129 203.0.113.509 6.07ms
130 203.0.113.513 5.98ms
131 203.0.113.517 6.04ms
132 203.0.113.521 5.97ms
133 203.0.113.525 6.09ms
134 203.0.113.529 5.95ms
135 203.0.113.533 6.03ms
136 203.0.113.537 5.98ms
137 203.0.113.541 6.05ms
138 203.0.113.545 5.96ms
139 203.0.113.549 6.07ms
140 203.0.113.553 5.98ms
141 203.0.113.557 6.04ms
142 203.0.113.561 5.97ms
143 203.0.113.565 6.09ms
144 203.0.113.569 5.95ms
145 203.0.113.573 6.03ms
146 203.0.113.577 5.98ms
147 203.0.113.581 6.05ms
148 203.0.113.585 5.96ms
149 203.0.113.589 6.07ms
150 203.0.113.593 5.98ms
151 203.0.113.597 6.04ms
152 203.0.113.601 5.97ms
153 203.0.113.605 6.09ms
154 203.0.113.609 5.95ms
155 203.0.113.613 6.03ms
156 203.0.113.617 5.98ms
157 203.0.113.621 6.05ms
158 203.0.113.625 5.96ms
159 203.0.113.629 6.07ms
160 203.0.113.633 5.98ms
161 203.0.113.637 6.04ms
162 203.0.113.641 5.97ms
163 203.0.113.645 6.09ms
164 203.0.113.649 5.95ms
165 203.0.113.653 6.03ms
166 203.0.113.657 5.98ms
167 203.0.113.661 6.05ms
168 203.0.113.665 5.96ms
169 203.0.113.669 6.07ms
170 203.0.113.673 5.98ms
171 203.0.113.677 6.04ms
172 203.0.113.681 5.97ms
173 203.0.113.685 6.09ms
174 203.0.113.689 5.95ms
175 203.0.113.693 6.03ms
176 203.0.113.697 5.98ms
177 203.0.113.701 6.05ms
178 203.0.113.705 5.96ms
179 203.0.113.709 6.07ms
180 203.0.113.713 5.98ms
181 203.0.113.717 6.04ms
182 203.0.113.721 5.97ms
183 203.0.113.725 6.09ms
184 203.0.113.729 5.95ms
185 203.0.113.733 6.03ms
186 203.0.113.737 5.98ms
187 203.0.113.741 6.05ms
188 203.0.113.745 5.96ms
189 203.0.113.749 6.07ms
190 203.0.113.753 5.98ms
191 203.0.113.757 6.04ms
192 203.0.113.761 5.97ms
193 203.0.113.765 6.09ms
194 203.0.113.769 5.95ms
195 203.0.113.773 6.03ms
196 203.0.113.777 5.98ms
197 203.0.113.781 6.05ms
198 203.0.113.785 5.96ms
199 203.0.113.789 6.07ms
200 203.0.113.793 5.98ms
201 203.0.113.797 6.04ms
202 203.0.113.801 5.97ms
203 203.0.113.805 6.09ms
204 203.0.113.809 5.95ms
205 203.0.113.813 6.03ms
206 203.0.113.817 5.98ms
207 203.0.113.821 6.05ms
208 203.0.113.825 5.96ms
209 203.0.113.829 6.07ms
210 203.0.113.833 5.98ms
211 203.0.113.837 6.04ms
212 203.0.113.841 5.97ms
213 203.0.113.845 6.09ms
214 203.0.113.849 5.95ms
215 203.0.113.853 6.03ms
216 203.0.113.857 5.98ms
217 203.0.113.861 6.05ms
218 203.0.113.865 5.96ms
219 203.0.113.869 6.07ms
220 203.0.113.873 5.98ms
221 203.0.113.877 6.04ms
222 203.0.113.881 5.97ms
223 203.0.113.885 6.09ms
224 203.0.113.889 5.95ms
225 203.0.113.893 6.03ms
226 203.0.113.897 5.98ms
227 203.0.113.901 6.05ms
228 203.0.113.905 5.96ms
229 203.0.113.909 6.07ms
230 203.0.113.913 5.98ms
231 203.0.113.917 6.04ms
232 203.0.113.921 5.97ms
233 203.0.113.925 6.09ms
234 203.0.113.929 5.95ms
235 203.0.113.933 6.03ms
236 203.0.113.937 5.98ms
237 203.0.113.941 6.05ms
238 203.0.113.945 5.96ms
239 203.0.113.949 6.07ms
240 203.0.113.953 5.98ms
241 203.0.113.957 6.04ms
242 203.0.113.961 5.97ms
243 203.0.113.965 6.09ms
244 203.0.113.969 5.95ms
245 203.0.113.973 6.03ms
246 203.0.113.977 5.98ms
22. Checking DNS Resolution
| Command | Description | Example |
|---|---|---|
| nslookup | Query DNS to resolve a hostname | nslookup google.com |
| dig | Diagnostic tool to query DNS name servers | dig google.com |
| host | Resolve a hostname to IP address | host google.com |
| ping | Test connectivity to a host using its IP or hostname | ping google.com |
Note: If DNS resolution fails, check your
/etc/resolv.conf file for correct nameserver entries.
Warning: Ensure that your firewall is not blocking DNS traffic (typically UDP port 53).
3. Viewing Open Ports and Connections
| Command | Description | Notes |
|---|---|---|
| netstat -tuln | Display listening TCP and UDP ports | Shows local addresses, port numbers, and states |
| ss -tuln | Display socket statistics (faster alternative to netstat) | More efficient than netstat for large numbers of connections |
| lsof -i | List open files and network connections | Can show process names associated with each connection |
| ss -tulnp | Include PID and program name in output | Useful for identifying which process is using a specific port |
Note: The
-p flag requires root privileges to show process names.
4. Scanning Network Ports
| Tool | Command | Description |
|---|---|---|
| nmap | nmap -p 1-65535 target-host |
Scan all ports on a target host for open services |
| nmap (specific port) | nmap -p 80 target-host |
Scan a specific port for service details |
| nc (netcat) | nc -zv target-host 22 |
Check if SSH port (22) is open on target host |
| telnet | telnet target-host 80 |
Attempt to connect to HTTP port (80) on target host |
Note: Port scanning can be detected by firewalls or intrusion detection systems. Ensure you have authorization before scanning any network.
5. Testing TCP Connections
| Command | Description | Example |
|---|---|---|
| telnet | Tests TCP connectivity to a host and port | telnet example.com 80 |
| nc (netcat) | Opens TCP/UDP connections and listens for connections | nc -zv example.com 443 |
| nmap | Network discovery and security auditing tool | nmap -p 80 example.com |
Example: Using netcat to test TCP connection
nc -zv google.com 80
Connection to google.com port 80 [tcp/http] succeeded!
Note: The
-z flag tells netcat to scan for listening daemons, and -v enables verbose output.
6. Capturing Network Packets
| Option | Values | Description |
|---|---|---|
| -i | interface |
Specify the network interface to capture on |
| -w | filename.pcap |
Write captured packets to a file in pcap format |
| -c | count |
Stop after capturing specified number of packets |
| -n | |
Do not resolve hostnames (show IP addresses instead) |
| -v | |
Verbose output (more details per packet) |
Note: The
tcpdump command requires root privileges or appropriate capabilities to capture packets.7. Analyzing Network Traffic
| Tool | Description | Usage Example |
|---|---|---|
| tcpdump | Command-line packet analyzer. Captures and displays network traffic. | tcpdump -i eth0 -n |
| Wireshark | GUI-based network protocol analyzer. Provides detailed packet inspection. | wireshark -i eth0 |
| tshark | Command-line version of Wireshark. Useful for scripting and automation. | tshark -i eth0 -f "tcp port 80" |
Note: Use
-s 0 in tcpdump to capture full packets instead of truncated ones.
Warning: Ensure you have appropriate permissions or are running as root to capture traffic on network interfaces.
8. Checking Network Performance
| Tool | Description | Usage Example |
|---|---|---|
| ping | Tests connectivity and measures latency to a host | ping -c 4 google.com |
| traceroute | Shows the path packets take to reach a destination | traceroute google.com |
| iftop | Displays real-time bandwidth usage per connection | iftop -i eth0 |
| nethogs | Shows bandwidth usage per process | nethogs eth0 |
| iperf3 | Measures network throughput between two hosts | iperf3 -c server_ip |
Example: Measuring Latency with ping
ping -c 4 google.com
PING google.com (142.250.191.14): 56 data bytes
64 bytes from 142.250.191.14: icmp_seq=0 ttl=116 time=25.3 ms
64 bytes from 142.250.191.14: icmp_seq=1 ttl=116 time=24.8 ms
64 bytes from 142.250.191.14: icmp_seq=2 ttl=116 time=25.1 ms
64 bytes from 142.250.191.14: icmp_seq=3 ttl=116 time=24.9 ms
--- google.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 24.8/25.0/25.3/0.2 msExample: Monitoring Bandwidth with iftop
iftop -i eth0
interface: eth0
IP address is: 192.168.1.100
MAC address is: aa:bb:cc:dd:ee:ff
2019-05-14 10:30:00
TX: 12.5KB/s RX: 8.7KB/s
Total: 21.2KB/s
2019-05-14 10:30:01
TX: 15.2KB/s RX: 9.3KB/s
Total: 24.5KB/s
Note: For detailed network performance analysis, combine tools like
ping, traceroute, and iperf3 to identify bottlenecks or latency issues in your network.
9. Displaying ARP Cache
| Command | Description | Example Output |
|---|---|---|
| arp -a | Display ARP cache entries (BSD/macOS style) | ? (192.168.1.1) at 00:11:22:33:44:55 on en0 ifscope permanent |
| ip neigh show | Display ARP cache entries (Linux style) | 192.168.1.1 dev enp0s3 lladdr 00:11:22:33:44:55 STALE |
| cat /proc/net/arp | Display raw ARP cache data from kernel | |
Note: The
ip neigh command is preferred over arp on modern Linux systems as it provides more detailed and consistent output.
ARP Cache Status Values
- REACHABLE: The entry is valid and the host is reachable
- STALE: The entry may be stale, needs verification
- DELAYED: The host is unreachable but the entry is not yet removed
- PROBE: The system is actively probing for the host
- FAILED: The host is unreachable and the entry has been removed
10. Flushing DNS Cache
| Command | Description | Notes |
|---|---|---|
| systemd-resolve --flush-caches | Flushes the DNS cache using systemd-resolved | Available on systems using systemd-resolved (common in modern Linux distributions) |
| nscd -i all | Invalidates all entries in the Name Service Caching Daemon cache | Used on systems with nscd running; may require root privileges |
| sudo /etc/init.d/dns-clean start | Starts the DNS cleaning service (if available) | Some distributions provide this script to flush DNS caches |
| killall -HUP nscd | Sends a SIGHUP signal to the Name Service Caching Daemon | Triggers nscd to reload its configuration and flush cache |
| sudo systemctl restart systemd-resolved | Restarts the systemd-resolved service | Effective way to clear DNS cache on systems using systemd-resolved |
Example: Flushing DNS Cache on Ubuntu 22.04
# Using systemd-resolve
sudo systemd-resolve --flush-caches
# Or restarting the service
sudo systemctl restart systemd-resolvedNote: On some systems, especially those using
dnsmasq or other local DNS servers, additional steps might be required to fully flush the cache depending on how the DNS resolution is configured.11. Diagnosing with curl and wget
| Command | Description | Use Case |
|---|---|---|
| curl | curl -I https://example.com |
Check HTTP headers without downloading content |
| curl -v | curl -v https://example.com |
Verbose output to see connection details and headers |
| curl --connect-timeout | curl --connect-timeout 10 https://example.com |
Set connection timeout to test responsiveness |
| wget | wget --spider https://example.com |
Check if a URL is accessible without downloading |
| wget -O /dev/null | wget -O /dev/null https://example.com |
Download to null device to test connectivity |
Example: Testing HTTP connectivity with curl
curl -I https://httpbin.org/get
HTTP/2 200
Content-Type: application/json
Server: meinheld/gevent
...
Example: Using wget to test URL availability
wget --spider https://httpbin.org/get
--2025-04-05 10:30:00-- https://httpbin.org/get
Connecting to httpbin.org|18.236.145.207|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Note: Both
curl and wget can be used to diagnose network issues. Use -v for verbose output and --connect-timeout to set timeouts.
Warning: If
curl -I returns a timeout, the issue might be DNS resolution or firewall blocking.