Network Configuration & Troubleshooting

# Monitor network events in real time — interface state changes, address changes
ip monitor all

# Watch interface statistics refresh every second
watch -n 1 'ip -s link show eth0'

# Manage the ARP cache — useful when a remote host has changed its MAC
ip neigh show
ip neigh flush dev eth0          # flush all ARP entries for eth0
sudo ip neigh add 192.168.1.50 lladdr 52:54:00:ab:cd:ef dev eth0  # add static entry

# Change interface MTU (e.g. for jumbo frames on a 10GbE network)
sudo ip link set eth0 mtu 9000

# Rename an interface
sudo ip link set eth0 name wan0

# Create a dummy interface for testing
sudo ip link add dummy0 type dummy
sudo ip addr add 10.99.0.1/24 dev dummy0
sudo ip link set dummy0 up

# ── Create a bond manually (temporary) ───────────────────────────

# Load the bonding kernel module
sudo modprobe bonding

# Create the bond interface
sudo ip link add bond0 type bond mode active-backup

# Add physical interfaces as bond members (take them down first)
sudo ip link set eth0 down
sudo ip link set eth1 down
sudo ip link set eth0 master bond0
sudo ip link set eth1 master bond0

# Bring the bond up and assign an IP
sudo ip link set bond0 up
sudo ip addr add 192.168.1.10/24 dev bond0

# Check bond status
cat /proc/net/bonding/bond0

# ── Create a VLAN sub-interface manually (temporary) ─────────────

sudo ip link add link eth0 name eth0.10 type vlan id 10
sudo ip addr add 10.10.0.5/24 dev eth0.10
sudo ip link set eth0.10 up

# View VLAN interfaces
ip link show type vlan

# All listening TCP sockets with process info
sudo ss -tlnp

# All established TCP connections
sudo ss -tnp state established

# All sockets — TCP + UDP + Unix
sudo ss -anp

# Filter by destination port — who is connected to port 443?
sudo ss -tnp dst :443

# Filter by source port — what are our outgoing connections on 5432?
sudo ss -tnp src :5432

# Filter by state — all sockets in TIME-WAIT
ss -tan state time-wait

# Count sockets per state — detect connection storms
ss -tan | awk 'NR>1 {state[$1]++} END {for(s in state) print s, state[s]}' | sort -k2 -rn

# Show socket memory usage — helpful for diagnosing buffer exhaustion
ss -tm

# Show detailed TCP internals — retransmits, RTT, congestion window
sudo ss -ti dst 8.8.8.8

# Capture on eth0 — show packet summaries (no DNS resolution, more verbose)
sudo tcpdump -i eth0 -n

# Capture only HTTPS traffic to/from a specific host
sudo tcpdump -i eth0 -n host 192.168.1.50 and port 443

# Capture all ICMP (ping) traffic to debug reachability
sudo tcpdump -i eth0 -n icmp

# Capture and save to a file for analysis in Wireshark
sudo tcpdump -i eth0 -n -w /tmp/capture.pcap

# Replay or read a saved capture file
sudo tcpdump -r /tmp/capture.pcap -n

# Print packet payload in ASCII — see HTTP requests/responses
sudo tcpdump -i eth0 -n -A port 80

# Print first 100 bytes of payload in hex + ASCII
sudo tcpdump -i eth0 -n -X -s 100 port 8080

# Capture only SYN packets — detect connection attempts (useful for DDoS detection)
sudo tcpdump -i eth0 -n 'tcp[tcpflags] & tcp-syn != 0 and tcp[tcpflags] & tcp-ack == 0'

# Step 1 — gateway reachable?
ping -c 3 $(ip route | grep default | awk '{print $3}')

# Step 2 — internet IP reachable?
ping -c 3 8.8.8.8

# Step 3 — DNS resolution working?
dig +short google.com
# or bypass system resolver to isolate:
dig @8.8.8.8 +short google.com

# Step 4 — target port open?
nc -zv target.example.com 443
# or:
timeout 3 bash -c 'cat < /dev/null > /dev/tcp/target.example.com/443' \
  && echo "port open" || echo "port closed/filtered"

# Step 5 — if port appears closed, confirm with tcpdump whether packets arrive
sudo tcpdump -i eth0 -n host target.example.com and port 443

# Check iptables rules if packets arrive but port appears closed
sudo iptables -L -n -v | grep -E "443|REJECT|DROP"