Top Linux Networking Commands: The 2026 Field Reference
Every Linux networking command that matters, grouped by the question it answers, with real captures from a four-hop lab and the triage order to run them in.
Jaime
Latest posts — page 10
ufw: Simple Firewalling on Debian and Ubuntu
Enable ufw without losing your SSH session, learn the rule grammar, and see exactly which iptables chains it builds underneath.
nftables: The Modern Linux Firewall
Your iptables rules already run on nftables. Handles, named sets, inet tables and atomic ruleset loads, all proven with real output from a live lab.
iptables Fundamentals: Tables, Chains, Real Rules
Tables, chains and rule order, demonstrated with real captures from a Debian host in a live lab: DROP against REJECT timing, conntrack, logging and NAT.
/proc/net and Networking sysctls: Where the Numbers Come From
Every Linux networking tool is a formatter over a handful of kernel files. Here is what is in them, how to read the hex, and what happens when you change the sysctls that matter.
iftop, nload, bmon, vnstat, nethogs Compared
Five live bandwidth monitors pointed at the same flow at the same time, with real terminal frames and a reconciliation of why they all report different numbers.
ngrep: grep for Network Traffic
Pattern matching against live packet payloads. The syntax, the hex mode, the file interop, and a real capture showing the server name leaking out of an encrypted session.
tshark: Wireshark in the Terminal
Wireshark’s full dissector library driven from an SSH session: capture filters against display filters, custom field output, ring buffers and the statistics taps that make triage fast.
SSH Beyond Login: Tunnels, Jump Hosts, scp/sftp
Local, remote and dynamic forwards, ProxyJump instead of agent forwarding, scp -O against IOS XE, and why telnet is still a fine port tester.
socat: Port Forwarding and Bidirectional Relays
One command joins any two endpoints: TCP, UDP, TLS, UNIX sockets, serial ports or a program. Port forwards, TLS wrappers and protocol bridges from real captures.
netcat: Port Checks, File Transfers, Listeners
Open, refused, timed out and no route to host are four different tickets. Plus banner grabs, file transfer with no server, and why UDP tests lie.
wget: Downloads, Mirrors, Connectivity Tests
The retry and resume behavior that makes wget worth keeping, spider mode as a health check, rate limiting, and the robots.txt rule that empties your mirror.