Unix Networking Commands (curl, wget, netstat, ss, nmap, dig, ping, traceroute)

Network diagnostics and data transfer: curl/wget (HTTP), netstat/ss (socket stats), nmap (port scanning), dig (DNS), ping/traceroute (connectivity).

Unix Commands
8 entries
CC0 — public domain

JSON18,684 B
YAML11,160 B · −40%
TOON10,648 B · −43%

Unix networking commands with purpose, common usage, important options and notes: curl, wget, ss, netstat, nmap, dig, ping and traceroute.

Use it when

You are diagnosing connectivity, DNS or open ports from the command line.
You need the right tool and flags for a network task.

Watch out for

Scanning networks you do not own or have permission to test may be illegal; use nmap only on authorized systems.
netstat is largely replaced by ss on modern Linux.

The data

Commands

Name

Purpose

Common usage

Important options

Example output type

Related commands

Notes

curl

Transfer data from or to a server using various protocols (HTTP, HTTPS, FTP, SCP, SFTP, etc.)

curl [options] <URL>

X <method>	H <header>	D <data>	Data binary <file>	O <file>	O	L	V	S	K	U <user:pass>	I
Specify HTTP method (GET, POST, PUT, DELETE)	null	null	null	null	null	null	null	null	null	null	null
null	Add custom header	null	null	null	null	null	null	null	null	null	null
null	null	HTTP POST data (application/x-www-form-urlencoded)	null	null	null	null	null	null	null	null	null
null	null	null	POST binary data from file	null	null	null	null	null	null	null	null
null	null	null	null	Write output to file	null	null	null	null	null	null	null
null	null	null	null	null	Save output with remote filename	null	null	null	null	null	null
null	null	null	null	null	null	Follow redirects	null	null	null	null	null
null	null	null	null	null	null	null	Verbose (show request/response headers)	null	null	null	null
null	null	null	null	null	null	null	null	Silent mode (no progress)	null	null	null
null	null	null	null	null	null	null	null	null	Allow insecure SSL connections	null	null
null	null	null	null	null	null	null	null	null	null	Basic authentication	null
null	null	null	null	null	null	null	null	null	null	null	Fetch headers only (HEAD request)

HTTP response body, headers, or status code (with -w)

wget
httpie
aria2

curl doesn't follow redirects by default (-L). Use -w '%{http_code}' to capture status. Supports multi-part uploads (-F). Can send multiple requests with --next. Extremely scriptable for API testing.

wget

Non-interactive network downloader. Retrieves files via HTTP, HTTPS, FTP.

wget [options] <URL>

O <file>	P <dir>	R	Np	N	C	Q	Nv	Limit rate <speed>	No check certificate
Output to specific filename (or - for stdout)	null	null	null	null	null	null	null	null	null
null	Save to directory	null	null	null	null	null	null	null	null
null	null	Recursive download (crawl)	null	null	null	null	null	null	null
null	null	null	No parent (stay within directory hierarchy)	null	null	null	null	null	null
null	null	null	null	Timestamp-check only download newer files	null	null	null	null	null
null	null	null	null	null	Continue partial downloads	null	null	null	null
null	null	null	null	null	null	Quiet output	null	null	null
null	null	null	null	null	null	null	Non-verbose but show errors	null	null
null	null	null	null	null	null	null	null	Throttle download speed	null
null	null	null	null	null	null	null	null	null	Ignore SSL cert errors

File saved to disk, progress bar on stderr

curl
aria2c
axel

wget is recursive by design (good for mirroring). -c resumable downloads work only if server supports Range header. Good for cron jobs (non-interactive). Can download multiple URLs from file via -i. Lacks curl's protocol variety.

ss (Socket Statistics)

Investigate network sockets and connections. Modern replacement for netstat (faster, more detailed).

ss [options] [filter]

T	U	L	A	N	P	I	S	E	M	4/ 6
TCP sockets	null	null	null	null	null	null	null	null	null	null
null	UDP sockets	null	null	null	null	null	null	null	null	null
null	null	Listening sockets only	null	null	null	null	null	null	null	null
null	null	null	All sockets (listening + established)	null	null	null	null	null	null	null
null	null	null	null	Numeric output (don't resolve names)	null	null	null	null	null	null
null	null	null	null	null	Show process using socket	null	null	null	null	null
null	null	null	null	null	null	Show internal information	null	null	null	null
null	null	null	null	null	null	null	Summary statistics	null	null	null
null	null	null	null	null	null	null	null	Extended socket info (timers, marks)	null	null
null	null	null	null	null	null	null	null	null	Show memory usage	null
null	null	null	null	null	null	null	null	null	null	IPv4/IPv6 only

Table: Netid, State, Recv-Q, Send-Q, Local Address:Port, Peer Address:Port, Process

netstat
lsof -i
ip
nmap

ss reads directly from kernel via netlink (faster than netstat's /proc parsing). Filters: state = (established, listen, etc.), dport = :80, src 192.168.1.1. -p requires root for other users' processes. Essential for diagnosing connections and listening ports.

netstat

Display network connections, routing tables, interface stats, masquerade connections, and multicast memberships.

netstat [options]

A	T	U	L	P	N	R	I	S	C	E
All sockets (listening + non-listening)	null	null	null	null	null	null	null	null	null	null
null	TCP connections	null	null	null	null	null	null	null	null	null
null	null	UDP connections	null	null	null	null	null	null	null	null
null	null	null	Listening sockets only	null	null	null	null	null	null	null
null	null	null	null	Show PID/Program name (requires sudo)	null	null	null	null	null	null
null	null	null	null	null	Numeric output (no DNS resolution)	null	null	null	null	null
null	null	null	null	null	null	Routing table	null	null	null	null
null	null	null	null	null	null	null	Interface statistics	null	null	null
null	null	null	null	null	null	null	null	Protocol statistics	null	null
null	null	null	null	null	null	null	null	null	Continuous update (like top)	null
null	null	null	null	null	null	null	null	null	null	Extended info (TCP states, etc.)

Table: Proto, Recv-Q, Send-Q, Local Address, Foreign Address, State, PID/Program name

ss
lsof
ip
ifconfig

netstat is deprecated in favor of ss and ip. Still ubiquitous. -anp shows all connections with processes. Routing table: netstat -rn. Interface stats: netstat -i. Use -s to see packet loss/errors per protocol. Can be slow on systems with many connections.

nmap

Network exploration and security auditing. Port scanning, service detection, OS fingerprinting.

nmap [options] <target>

S s	S t	S u	S v	O	A	P <ports>	Pn	T<0 5>	O n/ o x/ o g	Script <category>
TCP SYN scan (stealth, requires root)	null	null	null	null	null	null	null	null	null	null
null	TCP connect scan (no root)	null	null	null	null	null	null	null	null	null
null	null	UDP scan (slow)	null	null	null	null	null	null	null	null
null	null	null	Version detection (service/version info)	null	null	null	null	null	null	null
null	null	null	null	OS detection	null	null	null	null	null	null
null	null	null	null	null	Aggressive: OS + version + script + traceroute	null	null	null	null	null
null	null	null	null	null	null	Port range (e.g., -p 1-1000, -p 80,443)	null	null	null	null
null	null	null	null	null	null	null	Treat all hosts as online (skip ping)	null	null	null
null	null	null	null	null	null	null	null	Timing template (0=paranoid, 5=insane)	null	null
null	null	null	null	null	null	null	null	null	Output to normal/ XML/ grepable	null
null	null	null	null	null	null	null	null	null	null	Run NSE scripts (vuln, discovery)

Port table: PORT, STATE (open/closed/filtered), SERVICE, VERSION

masscan
hping3
netcat
dig

Scanning requires authorization. SYN scan (-sS) is stealthy but needs root. States: open (listening), closed (not listening), filtered (firewall). -p- scans all 65535 ports (slow). Version detection (-sV) helps identify services. NSE scripts automate vulnerability checks.

dig (Domain Information Groper)

DNS lookup utility. Query DNS servers for resource records. Powerful debugging tool for DNS issues.

dig [@server] <name> [<type>]

T <type>	@<server>	+short	+trace	+dnssec	+multiline	X <ip>	P <port>	+noall +answer
Query record type (A, AAAA, MX, NS, TXT, CNAME, SOA, ANY)	null	null	null	null	null	null	null	null
null	Query specific DNS server (default: /etc/resolv.conf)	null	null	null	null	null	null	null
null	null	Brief output (just answer)	null	null	null	null	null	null
null	null	null	Trace resolution from root servers	null	null	null	null	null
null	null	null	null	Request DNSSEC records (DNSKEY, RRSIG)	null	null	null	null
null	null	null	null	null	Wrap long records nicely	null	null	null
null	null	null	null	null	null	Reverse lookup (PTR)	null	null
null	null	null	null	null	null	null	Query non-standard port	null
null	null	null	null	null	null	null	null	Show only answer section

DNS response sections: ANSWER (records), AUTHORITY (NS records), ADDITIONAL (glue), STATUS (NOERROR/NXDOMAIN)

nslookup
host
whois

dig output shows header, question, answer, authority, additional sections. +short for quick checks. Use dig +trace to see full delegation chain. Reverse: dig -x 8.8.8.8. Compare answers from multiple servers by changing @1.1.1.1, @8.8.8.8.

ping

Test network reachability and round-trip time (RTT) using ICMP echo requests.

ping [options] <host/IP>

C <count>	I <interval>	W <timeout>	W <deadline>	S <size>	Q	F	I <interface>
Send only N packets (stop after N)	null	null	null	null	null	null	null
null	Wait N seconds between pings (default 1s)	null	null	null	null	null	null
null	null	Time to wait for response (seconds)	null	null	null	null	null
null	null	null	Total time to run (seconds)	null	null	null	null
null	null	null	null	Packet size (payload, default 56)	null	null	null
null	null	null	null	null	Quiet output (summary only)	null	null
null	null	null	null	null	null	Flood ping (requires root, rapid fire)	null
null	null	null	null	null	null	null	Source interface/address

Lines: 64 bytes from host: icmp_seq=N ttl=64 time=XX.X ms, plus summary statistics

traceroute
mtr
ping6
fping

Measures latency and packet loss. ICMP may be blocked by firewalls. Standard ping packet: 56 bytes data + 8 bytes ICMP header = 64 bytes total. Use ping -c 4 google.com for quick check. -f flood can be used for DoS testing (ethically only on your own network).

traceroute

Trace network path to destination, showing each hop (router) and round-trip time. Uses TTL expiration (ICMP Time Exceeded).

traceroute [options] <host>

M <max hops>	N	W <timeout>	Q <probes>	I	T	P <port>	F
Maximum number of hops (default 30)	null	null	null	null	null	null	null
null	Numeric output (no DNS lookups)	null	null	null	null	null	null
null	null	Wait time per probe (seconds)	null	null	null	null	null
null	null	null	Probes per hop (default 3)	null	null	null	null
null	null	null	null	Use ICMP echo instead of UDP	null	null	null
null	null	null	null	null	Use TCP SYN packets (port 80)	null	null
null	null	null	null	null	null	Destination port for UDP/TCP probes	null
null	null	null	null	null	null	null	First TTL (start from this hop)

Lines: hop_number host_name (IP) probe1_ms probe2_ms probe3_ms [* = timeout]

mtr
tracepath
ping

Shows path and latency per hop. Each hop decrements TTL; TTL=0 returns ICMP Time Exceeded. Some routers block ICMP, showing * (but path still exists). Use traceroute -I if UDP blocked. mtr combines traceroute + ping for continuous monitoring.

Fields

The shape of this dataset, read from the data itself: every column, its type and a real value. Agents can use this to plan a query without fetching the whole document.

Section	Field	Type	Example
commands	`name`	string	curl
commands	`purpose`	string	Transfer data from or to a server using various…
commands	`common_usage`	string	curl [options] <URL>
commands	`important_options`	array	[12 items]
commands	`example_output_type`	string	HTTP response body, headers, or status code (wi…
commands	`related_commands`	array	[3 items]
commands	`notes`	string	curl doesn't follow redirects by default (-L). …

Fetch the same bytes

The static files contain the same reference rows as the API, with no API rate limit. Live metadata, such as view counts, may differ. Use the API for content negotiation; use the static files for a cacheable snapshot.

curl "https://yjtoon.yunusemrevurgun.com/api/dataset/unix-networking-commands?format=toon"

const res = await fetch(
  "https://yjtoon.yunusemrevurgun.com/static-data/dataset/unix-networking-commands.toon"
);
const toon = await res.text();

Rate limit: 120 requests per minute per IP, no key and no signup. API reference →