api: YAML JSON TOON Database version: 1.0.0 format: toon dataset: id: 2921 slug: unix-networking-commands title: "Unix Networking Commands (curl, wget, netstat, ss, nmap, dig, ping, traceroute)" description: "Network diagnostics and data transfer: curl/wget (HTTP), netstat/ss (socket stats), nmap (port scanning), dig (DNS), ping/traceroute (connectivity)." summary: "Unix networking commands with purpose, common usage, important options and notes: curl, wget, ss, netstat, nmap, dig, ping and traceroute." use_when[2]: "You are diagnosing connectivity, DNS or open ports from the command line.",You need the right tool and flags for a network task. caveats[2]: Scanning networks you do not own or have permission to test may be illegal; use nmap only on authorized systems.,netstat is largely replaced by ss on modern Linux. related[4]: network-ports-reference,dns-fundamentals,http-request-headers,network-security-devices entry_count: 8 fields[7]{section,field,type,example}: commands,name,string,curl commands,purpose,string,Transfer data from or to a server using various… commands,common_usage,string,"curl [options] " commands,important_options,array,"[12 items]" commands,example_output_type,string,"HTTP response body, headers, or status code (wi…" commands,related_commands,array,"[3 items]" commands,notes,string,curl doesn't follow redirects by default (-L). … category: Unix Commands category_slug: unix-commands tags: "unix,linux,networking,curl,wget,dns,ports" view_count: 54 created_at: 1777673262 updated_at: 1777673262 data: commands[8]: - name: curl purpose: "Transfer data from or to a server using various protocols (HTTP, HTTPS, FTP, SCP, SFTP, etc.)" common_usage: "curl [options] " important_options[12]: - "-X ": "Specify HTTP method (GET, POST, PUT, DELETE)" - "-H
": Add custom header - "-d ": HTTP POST data (application/x-www-form-urlencoded) - "--data-binary ": POST binary data from file - "-o ": Write output to file - "-O": Save output with remote filename - "-L": Follow redirects - "-v": Verbose (show request/response headers) - "-s": Silent mode (no progress) - "-k": Allow insecure SSL connections - "-u ": Basic authentication - "-I": Fetch headers only (HEAD request) example_output_type: "HTTP response body, headers, or status code (with -w)" related_commands[3]: wget,httpie,aria2 notes: "curl doesn't follow redirects by default (-L). Use -w '%{http_code}' to capture status. Supports multi-part uploads (-F). Can send multiple requests with --next. Extremely scriptable for API testing." - name: wget purpose: "Non-interactive network downloader. Retrieves files via HTTP, HTTPS, FTP." common_usage: "wget [options] " important_options[10]: - "-O ": Output to specific filename (or - for stdout) - "-P ": Save to directory - "-r": Recursive download (crawl) - "-np": No parent (stay within directory hierarchy) - "-N": Timestamp-check only download newer files - "-c": Continue partial downloads - "-q": Quiet output - "-nv": Non-verbose but show errors - "--limit-rate ": Throttle download speed - "--no-check-certificate": Ignore SSL cert errors example_output_type: "File saved to disk, progress bar on stderr" related_commands[3]: curl,aria2c,axel notes: wget is recursive by design (good for mirroring). -c resumable downloads work only if server supports Range header. Good for cron jobs (non-interactive). Can download multiple URLs from file via -i. Lacks curl's protocol variety. - name: ss (Socket Statistics) purpose: "Investigate network sockets and connections. Modern replacement for netstat (faster, more detailed)." common_usage: "ss [options] [filter]" important_options[11]: - "-t": TCP sockets - "-u": UDP sockets - "-l": Listening sockets only - "-a": All sockets (listening + established) - "-n": Numeric output (don't resolve names) - "-p": Show process using socket - "-i": Show internal information - "-s": Summary statistics - "-e": "Extended socket info (timers, marks)" - "-m": Show memory usage - "-4/-6": IPv4/IPv6 only example_output_type: "Table: Netid, State, Recv-Q, Send-Q, Local Address:Port, Peer Address:Port, Process" related_commands[4]: netstat,lsof -i,ip,nmap notes: "ss reads directly from kernel via netlink (faster than netstat's /proc parsing). Filters: state = (established, listen, etc.), dport = :80, src 192.168.1.1. -p requires root for other users' processes. Essential for diagnosing connections and listening ports." - name: netstat purpose: "Display network connections, routing tables, interface stats, masquerade connections, and multicast memberships." common_usage: "netstat [options]" important_options[11]: - "-a": All sockets (listening + non-listening) - "-t": TCP connections - "-u": UDP connections - "-l": Listening sockets only - "-p": Show PID/Program name (requires sudo) - "-n": Numeric output (no DNS resolution) - "-r": Routing table - "-i": Interface statistics - "-s": Protocol statistics - "-c": Continuous update (like top) - "-e": "Extended info (TCP states, etc.)" example_output_type: "Table: Proto, Recv-Q, Send-Q, Local Address, Foreign Address, State, PID/Program name" related_commands[4]: ss,lsof,ip,ifconfig notes: "netstat is deprecated in favor of ss and ip. Still ubiquitous. -anp shows all connections with processes. Routing table: netstat -rn. Interface stats: netstat -i. Use -s to see packet loss/errors per protocol. Can be slow on systems with many connections." - name: nmap purpose: "Network exploration and security auditing. Port scanning, service detection, OS fingerprinting." common_usage: "nmap [options] " important_options[11]: - "-sS": "TCP SYN scan (stealth, requires root)" - "-sT": TCP connect scan (no root) - "-sU": UDP scan (slow) - "-sV": Version detection (service/version info) - "-O": OS detection - "-A": "Aggressive: OS + version + script + traceroute" - "-p ": "Port range (e.g., -p 1-1000, -p 80,443)" - "-Pn": Treat all hosts as online (skip ping) - "-T<0-5>": "Timing template (0=paranoid, 5=insane)" - "-oN/-oX/-oG": Output to normal/ XML/ grepable - "--script ": "Run NSE scripts (vuln, discovery)" example_output_type: "Port table: PORT, STATE (open/closed/filtered), SERVICE, VERSION" related_commands[4]: masscan,hping3,netcat,dig notes: "Scanning requires authorization. SYN scan (-sS) is stealthy but needs root. States: open (listening), closed (not listening), filtered (firewall). -p- scans all 65535 ports (slow). Version detection (-sV) helps identify services. NSE scripts automate vulnerability checks." - name: dig (Domain Information Groper) purpose: DNS lookup utility. Query DNS servers for resource records. Powerful debugging tool for DNS issues. common_usage: "dig [@server] []" important_options[9]: - "-t ": "Query record type (A, AAAA, MX, NS, TXT, CNAME, SOA, ANY)" - "@": "Query specific DNS server (default: /etc/resolv.conf)" - "+short": Brief output (just answer) - "+trace": Trace resolution from root servers - "+dnssec": "Request DNSSEC records (DNSKEY, RRSIG)" - "+multiline": Wrap long records nicely - "-x ": Reverse lookup (PTR) - "-p ": Query non-standard port - "+noall +answer": Show only answer section example_output_type: "DNS response sections: ANSWER (records), AUTHORITY (NS records), ADDITIONAL (glue), STATUS (NOERROR/NXDOMAIN)" related_commands[3]: nslookup,host,whois notes: "dig output shows header, question, answer, authority, additional sections. +short for quick checks. Use dig +trace to see full delegation chain. Reverse: dig -x 8.8.8.8. Compare answers from multiple servers by changing @1.1.1.1, @8.8.8.8." - name: ping purpose: Test network reachability and round-trip time (RTT) using ICMP echo requests. common_usage: "ping [options] " important_options[8]: - "-c ": Send only N packets (stop after N) - "-i ": Wait N seconds between pings (default 1s) - "-W ": Time to wait for response (seconds) - "-w ": Total time to run (seconds) - "-s ": "Packet size (payload, default 56)" - "-q": Quiet output (summary only) - "-f": "Flood ping (requires root, rapid fire)" - "-I ": Source interface/address example_output_type: "Lines: 64 bytes from host: icmp_seq=N ttl=64 time=XX.X ms, plus summary statistics" related_commands[4]: traceroute,mtr,ping6,fping notes: "Measures latency and packet loss. ICMP may be blocked by firewalls. Standard ping packet: 56 bytes data + 8 bytes ICMP header = 64 bytes total. Use ping -c 4 google.com for quick check. -f flood can be used for DoS testing (ethically only on your own network)." - name: traceroute purpose: "Trace network path to destination, showing each hop (router) and round-trip time. Uses TTL expiration (ICMP Time Exceeded)." common_usage: "traceroute [options] " important_options[8]: - "-m ": Maximum number of hops (default 30) - "-n": Numeric output (no DNS lookups) - "-w ": Wait time per probe (seconds) - "-q ": Probes per hop (default 3) - "-I": Use ICMP echo instead of UDP - "-T": Use TCP SYN packets (port 80) - "-p ": Destination port for UDP/TCP probes - "-f": First TTL (start from this hop) example_output_type: "Lines: hop_number host_name (IP) probe1_ms probe2_ms probe3_ms [* = timeout]" related_commands[3]: mtr,tracepath,ping notes: "Shows path and latency per hop. Each hop decrements TTL; TTL=0 returns ICMP Time Exceeded. Some routers block ICMP, showing * (but path still exists). Use traceroute -I if UDP blocked. mtr combines traceroute + ping for continuous monitoring."