Toolbox · Networking
Network Troubleshooting
Connectivity, DNS, ports, routing and packet capture from a Linux host or debug container.
On this page
Is it up? Is it reachable?
| Command | Purpose |
|---|---|
ping -c 3 host | ICMP reachability (may be blocked) |
nc -zv host 443 | TCP port check |
curl -sv --connect-timeout 3 https://host/ -o /dev/null | Full HTTP(S) handshake with timing |
curl -w '%{time_namelookup} %{time_connect} %{time_appconnect} %{time_starttransfer}\n' -o /dev/null -s https://host/ | Latency breakdown |
traceroute -T -p 443 host / mtr -T -P 443 host | Path with TCP probes |
DNS
| Command | Purpose |
|---|---|
dig +short A host / dig AAAA host | Resolve |
dig @1.1.1.1 host +trace | Full delegation trace |
dig -x 203.0.113.10 | Reverse lookup |
resolvectl status / cat /etc/resolv.conf | Resolver config |
nslookup host 10.96.0.10 | Query a specific server (cluster DNS) |
Local sockets and routes
| Command | Purpose |
|---|---|
ss -tulpn | Listening ports with process |
ss -tnp state established '( dport = :5432 )' | Connections to a port |
ip addr / ip -br link | Interfaces |
ip route get 8.8.8.8 | Which route/interface is used |
ip neigh | ARP table |
sysctl net.netfilter.nf_conntrack_count net.netfilter.nf_conntrack_max | Conntrack entries vs limit (exhaustion) |
Firewalls and policy
| Command | Purpose |
|---|---|
sudo iptables -S / sudo nft list ruleset | Host firewall rules |
sudo iptables -t nat -L -n -v | NAT rules (kube-proxy) |
kubectl get networkpolicy -A | Kubernetes policies |
Capture
| Command | Purpose |
|---|---|
sudo tcpdump -ni eth0 'tcp port 443 and host 203.0.113.10' -c 50 | Capture to screen |
sudo tcpdump -ni any -w /tmp/cap.pcap 'port 53' | Write pcap for Wireshark |
kubectl debug -it <pod> --image=nicolaka/netshoot --target=app | Capture inside a pod’s netns |
See also
- Cloud Network Security Boundaries: connection tests from the wrong side of each boundary, and the one that was not there.