Networking tools: ip, ss, dig, curl

Most 'the service is down' tickets are network questions you can answer with five commands.

Debug network problems layer by layer, from the interface up to the application:

Interfaces and addresses: ip addr (ip -br a for a brief view) shows interfaces, their state and IPs; ip link the link layer. The old ifconfig is deprecated.
Routes: ip route shows the routing table; the default via line is your gateway. ip route get 8.8.8.8 tells which route and source address a destination would use.
Reachability: ping -c 3 host (ICMP may be blocked by firewalls), tracepath or mtr for the path.
DNS: dig +short name or getent hosts name (which also honours /etc/hosts); resolvers are listed in /etc/resolv.conf, often pointing at the local systemd-resolved (check resolvectl status).
Ports: ss -tlnp lists listening TCP sockets with the owning process (run with sudo to see all), ss -tnp current connections. A service bound to 127.0.0.1 is reachable only from the machine itself; 0.0.0.0 or [::] means all interfaces.
Application: curl -v https://host/path shows the TLS handshake, request and response headers; nc -zv host 5432 tests whether a TCP port accepts connections.

Network configuration itself is distribution-specific: netplan on Ubuntu, NetworkManager (nmcli) on Fedora/RHEL and desktops, systemd-networkd elsewhere.

Example

ip -br addr                   # interfaces and addresses
# lo    UNKNOWN  127.0.0.1/8 ::1/128
# eth0  UP       192.168.1.20/24 fe80::1c2:3ff:fe4d:5e6f/64
ip route                      # default via 192.168.1.1 dev eth0 ...
ip route get 1.1.1.1          # which interface and source address would be used
ping -c 3 example.com         # reachability and latency
dig +short example.com        # DNS answer only
getent hosts db.internal      # resolve like applications do (incl. /etc/hosts)
sudo ss -tlnp                 # listening TCP ports with processes
# LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=812,fd=6))
curl -sS -o /dev/null -w '%{http_code} %{time_total}s\n' https://example.com
nc -zv db.internal 5432       # is the TCP port open?

Remember

Check interface, route, DNS, port, then application
ss -tlnp shows what listens where; 127.0.0.1 means local only
dig / getent for DNS, curl -v and nc -zv for services

Watch out for

Concluding a host is down because ping fails, when ICMP is simply blocked.

Check yourself

A web app works with curl on the server but not from other machines. ss shows it listening on 127.0.0.1:8080. Why?
Which command shows listening TCP ports and the processes that own them?

Official docs: man7.org/linux/man-pages/man8/ip.8.html

Example

Remember

Watch out for

Check yourself

Builds on

Unlocks