Command Line and Software Tools

What it is

A few command line tools answer most basic network questions. They show your address configuration, test reachability, trace the path, look up names, list connections and capture traffic.

The exam gives a problem and asks which tool or command fits, and sometimes asks what a command output means. Know the tool, the operating system and the question it answers.

How it works

Checking addresses and tables

Windows Command Prompt:
ipconfig /all          show full configuration
ipconfig /release      give up the DHCP address
ipconfig /renew        request a new DHCP address
ipconfig /flushdns     clear the local DNS cache
arp -a                 show the ARP table
route print            show the routing table

Linux shell:
ip addr                show addresses
ip route               show routes

Testing reachability and the path

ping sends Internet Control Message Protocol (ICMP) echo requests and reports replies, the round trip time and packet loss. A reply proves basic connectivity at layer 3, but a missing reply does not always mean the host is down, because ICMP may be blocked.

traceroute (tracert on Windows) lists each router along the path by sending packets with increasing Time to Live values. It shows where a path stops or slows.

Windows:  ping -t 192.0.2.10        continuous ping until stopped
Linux:    ping -c 4 192.0.2.10      four requests then stop
Windows:  tracert example.com
Linux:    traceroute example.com

A continuous ping while you change a cable or setting shows the moment connectivity returns. The address 127.0.0.1 tests the local network stack.

Checking names

nslookup example.com
dig example.com A
dig -x 192.0.2.10

The dig option -x does a reverse lookup. Query a specific server to find out whether the fault is in your local resolver or in the record.

Connections and ports

netstat lists active connections, listening ports and statistics for the Transmission Control Protocol (TCP) and User Datagram Protocol (UDP). The common options are shown here.

Windows:  netstat -an        all connections and listening ports, numeric
Windows:  netstat -ano       also shows the process ID
Linux:    ss -tuln           listening TCP and UDP ports (modern replacement)

nmap is a port scanner that finds hosts and open ports on a network. For example, nmap -p 1-1024 192.0.2.10 scans the first 1024 ports on one host. Only scan networks you are authorized to test.

Capturing packets

A protocol analyzer or packet capture tool records traffic and decodes it. Wireshark has a graphical interface, and tcpdump runs on the command line.

tcpdump -i eth0 port 53    capture DNS traffic on interface eth0

Packet captures show exactly what is sent, such as a failing handshake or a wrong DNS answer. Use filters to capture only what is needed.

Other software tools

Device show commands

These commands run on a switch or router (Cisco style syntax shown).

Switch# show mac address-table
Vlan   Mac Address      Type     Ports
10     0050.7966.6801   DYNAMIC  Gi1/0/5

Router# show ip arp
Protocol  Address       Age (min)  Hardware Addr   Type  Interface
Internet  192.168.1.10  5          0050.7966.6801  ARPA  Vlan10
Internet  192.168.1.20  0          Incomplete      ARPA

Switch# show vlan brief
VLAN Name     Status  Ports
10   Sales    active  Gi1/0/5

Switch# show power inline
Available:370.0(w)  Used:15.4(w)  Remaining:354.6(w)
Interface  Admin  Oper  Power(W)
Gi1/0/5    auto   on    15.4

If a MAC address shows up on a different port every few seconds, suspect a loop or a duplicate address. If the remaining PoE watts reach zero, new powered devices will not start.