Skip to main content

Chapter 7.4 - Network Tools

Learning Objectives​

By the end of this chapter, you will be able to:

  • Use network diagnostic tools
  • Monitor network connections
  • Analyze network traffic
  • Understand ports and services
  • Troubleshoot network issues

Diagnostic Tools​

ping - Connectivity Test​

# Simple ping
ping google.com
ping 8.8.8.8

# Limited number
ping -c 4 google.com

# Interval
ping -i 2 google.com  # Every 2 seconds

# Packet size
ping -s 1000 google.com  # 1000 bytes

# Timeout
ping -W 5 google.com  # 5 seconds

traceroute - Trace the Path​

# Trace route
traceroute google.com

# With tracepath (iputils)
tracepath google.com

# Max hops number
traceroute -m 15 google.com

# With mtr (real-time)
sudo apt install mtr
mtr google.com

Connections and Ports​

ss - Socket Statistics (Modern)​

# All connections
ss -tuln

# Options:
# -t: TCP
# -u: UDP
# -l: Listening
# -n: Numeric (no resolution)
# -p: Processes
# -a: All

# TCP connections
ss -tn

# UDP connections
ss -un

# Listening ports
ss -tuln | grep LISTEN

# Established connections
ss -tn | grep ESTAB

# By process
ss -tulnp

# By port
ss -tuln sport = :80
ss -tuln dport = :443

netstat - Network Statistics (Classic)​

# Install if necessary
sudo apt install net-tools

# All connections
netstat -tuln

# With processes
netstat -tulnp

# Established connections
netstat -tn

# Statistics
netstat -s

lsof - List Open Files​

# Open ports by process
sudo lsof -i

# Specific port
sudo lsof -i :80
sudo lsof -i :443

# TCP only
sudo lsof -iTCP

# By process
sudo lsof -i -p 1234

Traffic Analysis​

tcpdump - Packet Capture​

# Install
sudo apt install tcpdump

# Capture all
sudo tcpdump -i eth0

# Limited number
sudo tcpdump -c 10 -i eth0

# Filters
sudo tcpdump -i eth0 host 8.8.8.8
sudo tcpdump -i eth0 port 80
sudo tcpdump -i eth0 tcp port 443

# Save
sudo tcpdump -i eth0 -w capture.pcap

# Read file
tcpdump -r capture.pcap

wireshark - Graphical Analyzer​

# Install
sudo apt install wireshark

# Launch (GUI)
wireshark

# Or command line
tshark -i eth0

Network Information​

iftop - Bandwidth Monitor​

# Install
sudo apt install iftop

# Monitor interface
sudo iftop -i eth0

# Displays: connections, bandwidth used

nethogs - By Process​

# Install
sudo apt install nethogs

# Monitor
sudo nethogs

# Specific interface
sudo nethogs eth0

bmon - Bandwidth Monitor​

# Install
sudo apt install bmon

# Monitor
bmon

# Specific interface
bmon -p eth0

Firewall and iptables​

View Rules​

# iptables
sudo iptables -L -n -v

# With line numbers
sudo iptables -L -n -v --line-numbers

# By table
sudo iptables -t nat -L -n -v
sudo iptables -t mangle -L -n -v

ufw (Ubuntu Firewall)​

# Status
sudo ufw status

# Enable
sudo ufw enable

# Rules
sudo ufw allow 22/tcp
sudo ufw deny 80/tcp
sudo ufw delete allow 80/tcp

System Information​

Network Statistics​

# Interface statistics
ip -s link show

# Detailed statistics
cat /proc/net/dev

# Statistics by protocol
cat /proc/net/snmp

Interface Information​

# With ethtool
ethtool eth0
ethtool -S eth0  # Statistics
ethtool -i eth0  # Driver information

# With ip
ip -d link show eth0

Useful Scripts​

Complete Check​

#!/bin/bash
# Complete network diagnostic

echo "=== Interfaces ==="
ip addr show

echo "=== Routes ==="
ip route show

echo "=== DNS ==="
cat /etc/resolv.conf

echo "=== Connections ==="
ss -tuln

echo "=== Connectivity test ==="
ping -c 2 8.8.8.8

echo "=== Listening ports ==="
ss -tuln | grep LISTEN

Monitoring Bandwidth​

#!/bin/bash
# Monitor bandwidth

INTERFACE="eth0"

while true; do
    RX_BYTES=$(cat /sys/class/net/$INTERFACE/statistics/rx_bytes)
    TX_BYTES=$(cat /sys/class/net/$INTERFACE/statistics/tx_bytes)
    
    sleep 1
    
    RX_BYTES_NEW=$(cat /sys/class/net/$INTERFACE/statistics/rx_bytes)
    TX_BYTES_NEW=$(cat /sys/class/net/$INTERFACE/statistics/tx_bytes)
    
    RX_RATE=$(( (RX_BYTES_NEW - RX_BYTES) / 1024 ))
    TX_RATE=$(( (TX_BYTES_NEW - TX_BYTES) / 1024 ))
    
    echo "RX: ${RX_RATE} KB/s  TX: ${TX_RATE} KB/s"
done

Summary​

In this chapter, you learned:

Diagnostic: ping, traceroute, mtr
Connections: ss (modern), netstat (classic), lsof
Analysis: tcpdump, wireshark for capture
Monitoring: iftop, nethogs, bmon for bandwidth
Firewall: iptables, ufw for rules
Statistics: /proc/net/, ip -s, ethtool
Scripts: Automation diagnostics

Next Steps​

Module 8: Services and Daemons (with advanced crons)
Module 9: System Security

Chapter created on: December 2024