Cisco Trunk Up, Linux Ping Fails: Find the VLAN Mismatch
Build a working Linux-to-Cisco VLAN link, move the host to the wrong VLAN, and use ARP captures and the MAC table to find and fix the failed ping.
Troubleshooting
Broken networks, reproduced on purpose. Articles tagged Troubleshooting walk a fault from symptom to root cause using show commands, captures and a repeatable method.
Latest posts
TCP Three-Way Handshake and Teardown, Captured
The three-way handshake is the first thing anyone learns about TCP and the last thing most people actually look at. SYN, SYN-ACK, ACK is easy to draw. What is harder, and far more useful, is reading a real
DHCP DORA Explained with a Real Packet Capture
Discover, Offer, Request, Ack. You can recite DORA in your sleep, and it still will not help you the day a client comes up with a 169.254 address and the server insists the pool is fine. What helps is
OSPF Hello Packets Explained with a Real Capture
Every OSPF adjacency you have ever built started with a Hello packet, and almost every adjacency that refuses to build is a Hello packet being quietly thrown away. The trouble is that show ip ospf neighbor only tells you the
members
Linux Networking Field Reference (10-Page Printable Cheat-Sheet)
Ten printable pages of Linux networking commands, flags and real lab output, including a ten-symptom troubleshooting decision tree. Free for members.
Top Linux Networking Commands: The 2026 Field Reference
Every Linux networking command that matters, grouped by the question it answers, with real captures from a four-hop lab and the triage order to run them in.
/proc/net and Networking sysctls: Where the Numbers Come From
Every Linux networking tool is a formatter over a handful of kernel files. Here is what is in them, how to read the hex, and what happens when you change the sysctls that matter.
iftop, nload, bmon, vnstat, nethogs Compared
Five live bandwidth monitors pointed at the same flow at the same time, with real terminal frames and a reconciliation of why they all report different numbers.
ngrep: grep for Network Traffic
Pattern matching against live packet payloads. The syntax, the hex mode, the file interop, and a real capture showing the server name leaking out of an encrypted session.
tshark: Wireshark in the Terminal
Wireshark’s full dissector library driven from an SSH session: capture filters against display filters, custom field output, ring buffers and the statistics taps that make triage fast.
socat: Port Forwarding and Bidirectional Relays
One command joins any two endpoints: TCP, UDP, TLS, UNIX sockets, serial ports or a program. Port forwards, TLS wrappers and protocol bridges from real captures.
netcat: Port Checks, File Transfers, Listeners
Open, refused, timed out and no route to host are four different tickets. Plus banner grabs, file transfer with no server, and why UDP tests lie.