networking

ip & interfaces

bash# all interfaces and addresses
ip addr show

# routing table
ip route show

# arp cache
ip neigh

# set link up/down
ip link set eth0 up

sockets & connections

bash# all listening tcp ports
ss -tlnp

# all listening udp ports
ss -ulnp

# established connections
ss -tn state established

# process using a specific port
ss -tlnp | grep :6443

dns

bash# resolve hostname
dig google.com +short
host google.com

# reverse lookup
dig -x 8.8.8.8 +short

# query specific nameserver
dig @1.1.1.1 google.com

tcpdump

bash# capture on interface
tcpdump -i eth0

# with port filter
tcpdump -i eth0 port 80

# capture http traffic (readable)
tcpdump -i eth0 -A port 80

# write to file
tcpdump -i eth0 -w capture.pcap

# read file
tcpdump -r capture.pcap

wireguard

bash# show wireguard status
sudo wg show

# show interface
ip link show wg0
ip addr show wg0

# handshake and transfer stats
sudo wg show wg0

# test tunnel latency
ping -c 5 10.0.0.1

# speed test through tunnel
curl --interface wg0 -o /dev/null -s -w '%' \
  'https://speed.cloudflare.com/__down?bytes=50000000'