Networking Commands

Reviewed & published by Brayan K

By the end of this lesson you'll be able to diagnose a network from the terminal: check whether a host is up, fetch URLs and download files, see your own IP, find what is listening on a port, resolve domain names, and trace the path packets take.

Part of the free Command Line course at LearnCodingFast — hands-on lessons with worked examples and the output they print, plus practice exercises and a quick quiz.

What You'll Learn

• Test reachability and latency with ping (and stop it with -c 4 or Ctrl+C)
• Fetch URLs and headers with curl, and download files with wget
• View your interfaces and IP addresses with ip addr (vs legacy ifconfig)
• List listening TCP/UDP ports with ss -tuln (or netstat -tuln)
• Resolve domain names with dig, nslookup and host
• Trace the route to a host with traceroute, and understand ports and /etc/hosts

1. ping: Is the Host Reachable?

ping <host> sends small ICMP echo requests and waits for replies, so it answers two questions at once: can I reach this host, and how fast (the round-trip time). By default ping keeps going until you press Ctrl+C; add -c 4 to send exactly four packets and stop. Watch the packet loss line in the summary — 0% is healthy.

# ping sends small ICMP "echo" packets to a host and times the reply.
# It answers two questions: can I reach this host, and how fast?
# By default ping runs forever — press Ctrl+C to stop it.
# Use -c 4 to send exactly 4 packets and then stop on its own.

ping -c 4 example.com

2. HTTP from the Terminal: curl & wget

Two tools fetch things over the web. curl <url> prints a URL to the screen — add -I for just the response headers, or -O to save it to a file. wget <url> downloads a file to disk, and wget -O name url sets the output filename. In short: reach for curl to inspect APIs and headers, and wget to download or mirror files.

# curl fetches a URL and prints it to the screen. Great for APIs
# and quickly checking what a server sends back.
curl https://example.com

# -I shows ONLY the response headers (a HEAD request) — perfect
# for checking a status code or content type without the body.
curl -I https://example.com

# -O saves the response to a file named after the URL.
curl -O https://example.com/report.txt

# wget is built for DOWNLOADING files to disk (and mirroring sites).
wget https://example.com/report.txt

# -O sets the output filename yourself.
wget -O notes.txt https://example.com/report.txt

3. Your Interfaces & IP: ip addr

ip addr (short: ip a) lists every network interface and the IP addresses assigned to it. lo is loopback (your own machine, 127.0.0.1); eth0/wlan0 is your wired/wireless link with its real address like 192.168.1.42. On modern Linux this replaces the older ifconfig, which is legacy/deprecated on Linux but still standard on macOS.

4. What's Listening? ss -tuln

When you need to know which service is listening on a port, use ss -tuln. The flags read like a sentence: t = TCP, u = UDP, l = listening, n = numeric (show port numbers instead of names). Scan the Local Address:Port column to find, say, :8080. The older netstat -tuln does exactly the same job on systems without ss.

# ss lists network sockets. The flags read like a sentence:
#   -t  TCP        -u  UDP
#   -l  listening  -n  numeric (show port numbers, not names)
# So  ss -tuln  means "show listening TCP and UDP ports, numerically".
# This is how you answer: what is listening on port 8080?

ss -tuln

# The older 'netstat -tuln' does the same job on systems without ss.

5. Resolving Names: dig, nslookup & host

DNS turns a name like example.com into an IP address. Three tools do the lookup: host <domain> gives a one-line answer, nslookup <domain> is the classic tool that also shows the server it asked, and dig <domain> gives the most detailed view. For scripts, dig +short example.com prints just the IP — nothing else.

# DNS turns a name like example.com into an IP address.
# These three tools all do that lookup, simplest to most detailed:

host example.com          # the simplest one-line answer

nslookup example.com      # classic, shows the server it asked

dig example.com           # most detailed — full DNS record view

# dig +short prints JUST the IP address, perfect for scripts:
dig +short example.com

6. The Path & Remote Access: traceroute & ssh

traceroute <host> (called tracert on Windows) shows every hop — each router between you and the destination — along with how long each takes. It's how you spot where a connection slows down or stops. To actually work on a remote machine, ssh user@host opens a secure shell on it; the dedicated SSH lesson covers keys and config.

# traceroute shows the PATH packets take — each router ("hop")
# between you and the destination, with the time to reach it.
# On Windows the command is 'tracert'.

traceroute example.com

# Remote access: ssh opens a secure shell on another machine.
# Format is ssh user@host. (See the dedicated SSH lesson for keys.)
ssh ada@example.com

7. Ports & /etc/hosts

A port number identifies a specific service on a host: 22 is SSH, 80 is HTTP, 443 is HTTPS, 53 is DNS. So 192.168.1.42:443 means "the HTTPS service on that machine". The /etc/hosts file is a local hostname-to-IP map that the system checks before DNS — perfect for local overrides, like pointing a test name at 127.0.0.1.

# A PORT number identifies a specific service on a host. A handful
# you will see constantly:
#    22  -> SSH        80  -> HTTP        443 -> HTTPS
#    53  -> DNS        25  -> SMTP (mail)
# So 192.168.1.42:443 means "the HTTPS service on that machine".

# /etc/hosts is a LOCAL hostname-to-IP file, checked BEFORE DNS.
# Add a line to point a name wherever you want — great for testing.
# (Viewing it here; editing needs sudo.)

cat /etc/hosts

🎯 Your Turn: ping a fixed number of times

Fill in the one blank marked ___ using the # 👉 hint so ping sends a fixed count and stops on its own, then run it and check the Output panel.

# 🎯 YOUR TURN — ping a host exactly 3 times, then have it stop.

# 1) Use the flag that limits the number of packets to 3.
ping ___ 3 example.com         # 👉 replace ___ with  -c

# ✅ It sends 3 echo requests and prints a short statistics summary,
#    instead of running forever until you press Ctrl+C.

🎯 Your Turn: list listening ports

One blank again: combine the four flags (TCP, UDP, listening, numeric) into the right option for ss. Then run it.

# 🎯 YOUR TURN — list every LISTENING TCP and UDP port, numerically.

# 1) Combine the flags: t (TCP), u (UDP), l (listening), n (numeric).
ss ___                         # 👉 replace ___ with  -tuln

# ✅ Expected: a table of listening sockets with their port numbers,
#    e.g. 0.0.0.0:22 for SSH and 0.0.0.0:443 for HTTPS.

Pro Tips

• 💡 Practical recipe: to debug "the site is down", check connectivity (ping / curl -I), check what is listening (ss -tuln), then resolve the name (dig / nslookup).
• 💡 dig +short for scripts: it prints only the IP, so you can drop it straight into a variable or another command.
• 💡 curl prints, wget downloads: remember the split — curl for APIs and headers, wget for saving files to disk.
• 💡 Modern over legacy: prefer ip addr over ifconfig and ss over netstat — same ideas, current tools.

Common Errors (and the fix)

• ping never stops — that's normal: by default it runs forever. Press Ctrl+C to stop, or use ping -c 4 host to send a fixed number.
• "command not found: ifconfig" (or netstat) — these legacy tools may not be installed on modern Linux. Use ip addr and ss -tuln instead.
• ping fails but the website works — many servers block ICMP. A failed ping doesn't always mean "down"; confirm with curl -I https://host.
• "could not resolve host" — a DNS problem, not a connectivity one. Test resolution directly with dig example.com or nslookup example.com.
• "Permission denied" editing /etc/hosts — that file is system-owned. Open it with sudo (e.g. sudo nano /etc/hosts) to change it.

📋 Quick Reference

Mini-Challenge: a server health check

No blanks this time — just a brief. Combine what you've learned into a small, repeatable routine that resolves a host, confirms it's reachable, and checks that its web service is responding. Compare your results against the notes in the comments.

# 🎯 MINI-CHALLENGE: a one-line "health check" routine
# Goal: confirm a server is up, find its IP, and see what it serves.
#
# 1. Resolve the name to an IP with  dig +short example.com
#    (or  nslookup example.com  if dig is not installed).
# 2. Check reachability with  ping -c 4 example.com  and read the
#    packet-loss line.
# 3. Check the web service is answering with  curl -I https://example.com
#    and read the HTTP status line (look for 200).
# 4. Bonus: on the server itself, run  ss -tuln  to confirm the
#    service is actually LISTENING on the port you expect (e.g. 443).
#
# ✅ You now have a repeatable way to ask: is it up, what is its IP,
#    and is the service listening and responding?

# your commands here

🎉 Lesson Complete!

• ✅ ping -c 4 host tests reachability and latency; Ctrl+C stops a running ping
• ✅ curl prints URLs and headers (-I, -O); wget downloads files to disk
• ✅ ip addr shows interfaces and IPs (replacing legacy ifconfig); ss -tuln lists listening ports
• ✅ dig / nslookup / host resolve names; dig +short prints just the IP
• ✅ traceroute shows the path; ports identify services; /etc/hosts overrides DNS locally

Practice quiz

Continue this course

• Previous: Scheduling Tasks with cron
• Next: Advanced Bash Scripting — Functions, arrays, traps, set -euo pipefail and debugging with set -x
• Quick reference: Command Line cheat sheet

Frequently asked questions

What is the difference between curl and wget?

Both fetch things over HTTP. curl prints the response to the screen by default and is excellent for calling APIs and inspecting headers — it speaks many protocols and is highly scriptable. wget is built for downloading: it saves files to disk by default, shows a progress bar, can resume interrupted downloads, and can mirror entire sites. Rule of thumb: curl to print or call an API, wget to download a file.

ifconfig vs ip addr — which should I use?

Use ip addr (or the short ip a) on modern Linux. The ip command is the current, actively maintained tool for viewing interfaces and IP addresses. ifconfig is legacy and deprecated on Linux (often not even installed by default anymore), though you will still meet it in old tutorials and it remains the standard tool on macOS. Learn ip; recognize ifconfig.

How do I see what is listening on a specific port, like 8080?

Run ss -tuln to list all listening TCP/UDP sockets with their port numbers (the flags mean t=TCP, u=UDP, l=listening, n=numeric). Scan the Local Address:Port column for :8080. On older systems without ss, netstat -tuln does the same job. This is the standard way to find which service owns a port.

What is the difference between nslookup and dig?

Both resolve a domain name to an IP via DNS. nslookup is the older, simpler tool that prints a short answer and the server it queried. dig is more detailed and script-friendly: it shows full DNS records, and dig +short prints just the IP address — ideal for use inside scripts. host is an even simpler one-line alternative.

What is /etc/hosts and why does it matter?

/etc/hosts is a plain text file that maps hostnames to IP addresses on your local machine, and the system checks it BEFORE asking DNS. That makes it perfect for local overrides — for example mapping myproject.local to 127.0.0.1 so you can test a site under a friendly name, or temporarily pointing a domain at a different server. Editing it requires sudo.

Related lessons

• Shell Scripting Basics
• SSH lesson