To troubleshoot networking, there's a couple of utilities that can be used.
We have already seen quite a few of them, here is a list of all the utilities and how
you can use them.
Nmap, to start with, can be used to analyze open ports.
And you have learned how Nmap can be considered a hostile utility by network administrators,
so be careful if you use it.
Netstat, which is legacy and its modern counterpart, SS, can be used to provide a list of local
ports, so that you can figure out what is listening where.
iFtop gives a live overview of network traffic on all local interfaces.
Route is the legacy tool used to manipulate the routing table.
On modern Linux you would use iproute instead.
iperf is a utility that you can install on server and client to measure network throughput.
And tcpdump is used to analyze network traffic.
It will be dumped on your screen and you can read it or redirect it to a PCAP file, which
is a packet capture file.
Wireshark is a graphical utility, and you can use it to analyze packet capture files,
for instance, or monitor live traffic passing by based on specific input filters.
Netcat is also known as the Swiss army knife for networking, and it contains many tools.
The main command is nc, and nc is commonly used to test availability of ports.
Traceroute is what allows administrators to analyze the path between source and destination.
And tracepath is giving similar output.
MRT combines the functionality of traceroute and ping in one utility.
ARP is what is showing the IP address to MAC address resolution tables.
And nslookup is the old utility with its modern counterpart, dig, which are used for DNS name
lookup and checking if your DNS lookup is doing all right.
Whois is used to query a DNS domain and request advanced information.
And ping is used to test connectivity.
And finally, the IP utility is the overall management utility that allows you to do a
runtime configuration of your network and to check current settings in your network stack.
Let's check a couple of these.
So let's ping to nu.nl to start with the basic utility.
I like nu.nl because it's short to type and it's convenient.
So we can see the ICMP package.
These are the packages that are sent.
TTL is the maximum number of hops between the local location and the destination.
And time is around trip time, 18.9 milliseconds, which for internet-based traffic is not bad at all.
Now, if I would want to see the current route to this nu.nl, I can try a utility like tracepath.
And there I can see all the information about what is between my host and the remote host.
But the disappointing thing about it is that many hosts in between are hiding their answer
because for security purposes, they don't want to reveal themselves.
And that makes tracepath as well as traceroute of limited use nowadays.
Completely different utility is arb.
Use arb-a to get an overview of the arb table.
And the arb table is a match between IP addresses and MAC addresses.
Sometimes there might be a problem of a double MAC address.
And if you have a double MAC address, which means two nodes that are using the same MAC address,
that is going to confuse your networking.
And arb is going to figure that out for you.
And if ever you want to delete one of them, well, you can just use arb-d.
And that will delete the selected entry for you.
So, arb-d on 192.168.29.145 is going to remove the entry.
And then when I'm using ping on, well, this IP address again,
in order to get an answer, we do need the MAC address again.
And behind the scene, the ping command is triggering a Whois request
to figure out the MAC address behind this IP address.
I also like the dig utility, dig on not-existing.com.
That is, I think it's not existing.
And if it's not existing, we should be able to confirm using dig.
nx-domain, that's the output that I'm looking for.
If ever you see nx-domain, that stands for no such domain.
And that means, my friend, you are trying to reach a host that doesn't exist.
If, however, you would use dig-nu.nl, then we can see a status of no error.
And we can see the question section,
which is we're asking for the IP address of nu.nl.
And here we can see the answer section, which is revealing a couple of IP addresses.
And that should prove that the host that you are trying to reach
is reachable by DNS.