EMZETT.
Login

Emzett Wiki

Network diagnostics on Linux: ss, lsof, tcpdump and mtr

Properties1
tagsglossar, netzwerk, linux

2 min read

Network diagnostics on Linux: ss, lsof, tcpdump and mtr

In short: With ss and lsof you see which programs listen on or are connected to which ports, with tcpdump the traffic and with mtr the path including packet loss to the target.

In more detail: When “the network does not work”, a layer-by-layer diagnosis helps: cable/Wi-Fi, IP, gateway, DNS, port, application. Linux supplies small tools for it.

In Depth

Own configuration and connections

ip a                 # addresses and interfaces
ip r                 # routes (gateway)
resolvectl status    # DNS servers
ss -tulpn            # listening ports + process (TCP/UDP)
ss -tn state established    # active connections
sudo lsof -iTCP:8080 -sTCP:LISTEN    # who occupies port 8080?
sudo lsof -i -nP | head

ss replaces netstat. -p shows the process (needs root for others’). EADDRINUSE/“port already allocated” is clarified by ss/lsof.

Checking reachability

ping -c 4 1.1.1.1          # internet by IP?
ping -c 4 example.org      # DNS + internet?
dig example.org +short     # DNS resolution
curl -I https://example.org   # HTTP(S) response
nc -zv server 443          # port open? (netcat)
openssl s_client -connect example.org:443 -servername example.org
traceroute example.org
mtr -rwz example.org       # path + loss per hop

mtr combines ping and traceroute: loss that continues to the target is real; loss only at an intermediate hop is often ICMP rate limiting, not a problem.

tcpdump: looking at packets

sudo tcpdump -i eth0 -nn port 53          # DNS traffic
sudo tcpdump -i any -nn host 203.0.113.5 and tcp port 443
sudo tcpdump -i eth0 -w capture.pcap      # to file, later in Wireshark

Shows handshakes (SYN, SYN-ACK), resets, retransmissions, DNS replies. Helps with “connection drops” and firewall questions. Legal/privacy: capture only in your own network or with permission; captures contain passwords/data, store safely and delete. TLS content stays encrypted.

Systematic procedure

  1. Link: cable, Wi-Fi connected? (ip link).
  2. IP/gateway: ip a, ping gateway.
  3. Internet by IP: ping 1.1.1.1.
  4. DNS: dig/resolvectl query.
  5. Port/service: nc -zv, curl -v.
  6. Check firewall/proxy/VPN (nft list ruleset, proxy variables).
  7. Server side: is the service listening (ss -tulpn), right interface (127.0.0.1 vs 0.0.0.0)?
  8. Details: tcpdump, logs (journalctl -u service). Document results; typical causes: wrong DNS, blocked port, wrong bind address.

See also: Ping, Wireshark, netstat, EADDRINUSE

Backlinks