Cheat sheet

Networking and SSH

Addresses, routes and DNS, checking whether something is reachable, and getting around with SSH.

Nothing you type here is sent. Nothing is saved, unless you switch on Remember. Privacy policy

The ip, ss and nmcli commands come with any modern Linux. dig is in dnsutils on Debian and Ubuntu (bind-utils on Fedora, Rocky and RHEL), and nc is in netcat-openbsd (nmap-ncat).

Addresses and routes

ip -br a

Every network interface and its addresses, one line each.

-br: brief

ip a show eth0

Everything about one interface.

ip r

The routing table. The default via line is your gateway.

ip route get 192.0.2.10

Which interface and gateway this machine would use to reach an address.

ip -br link

Which interfaces are up and which are down.

ip neigh

The machines nearby that this one has talked to, with their hardware (MAC) addresses.

nmcli device status

Interfaces as NetworkManager sees them, on systems that use it (Fedora, Rocky, RHEL, desktops).

resolvectl status

Which DNS servers each interface uses, on systems with systemd-resolved (Ubuntu and others).

DNS

dig +short example.com

Just the address a name points to.

dig example.com

The full answer, with how long it's cached for (the TTL) and which server answered.

dig @1.1.1.1 example.com

Ask a particular DNS server. Compare with your own to spot a stale or split answer.

dig example.com MX +short

Where a domain's email goes. Swap MX for TXT, NS or CNAME for other records.

dig -x 192.0.2.10 +short

The name an address points back to (reverse DNS).

getent hosts example.com

What this machine really resolves a name to, /etc/hosts included. dig skips /etc/hosts, this doesn't.

Is it reachable?

ping -c 4 example.com

Four pings, then stop. No reply doesn't always mean down: plenty of firewalls drop pings.

mtr example.com

Every hop on the way there, live, with where packets go missing. tracepath if mtr isn't installed.

nc -zv example.com 443

Is a port open? Answers in a second instead of hanging like telnet.

-z: just check, send nothing
-v: say what happened

curl -I https://example.com/

Just the response headers from a website.

curl -sS -o /dev/null -w '%{http_code} %{time_total}s\n' https://example.com/

The status code and how long the page took. Run it in a loop to watch a deploy.

curl --resolve example.com:443:192.0.2.10 https://example.com:443/

Test a new server before DNS points at it: connect to that address while asking for the real name.

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

Who a site's certificate is for and when it expires.

Who's talking

sudo ss -tulpn

Everything listening for connections (TCP and UDP), and which program it is.

-tu: TCP and UDP
-l: listening only
-p: the program (that's why it needs sudo)
-n: numbers, not names

ss -tn state established

The connections open right now.

sudo lsof -i :443

Which program is using a port.

SSH

ssh deploy@example.com

ssh -J deploy@bastion.example.com deploy@example.com

-J: hop through this machine first

ssh -L 8080:localhost:443 deploy@example.com

Reach a port that's only open on the remote machine: browse to localhost:8080 here and you're talking to it there.

-L: forward a local port to the far end

ssh-keygen -t ed25519

Make yourself a new SSH key (ed25519 is the modern choice).

ssh-copy-id deploy@example.com

Put your public key on a machine so you can log in without a password.

ssh-keygen -R example.com

Forget a machine's old host key, after it's been rebuilt and SSH starts shouting about it.

scp notes.txt deploy@example.com:

Copy a file to your home folder on another machine.

rsync -avz ~/projects/ deploy@example.com:backup/

Copy a folder's contents to another machine. Run it again and it only sends what changed.

-a: keep permissions, dates and links
-z: compress on the way
/: on the end of the source: copy what's inside it, not the folder itself