{ "api": "YAML JSON TOON Database", "version": "1.0.0", "format": "json", "dataset": { "id": 36, "slug": "unix-networking-commands", "title": "Unix Networking Commands (curl, wget, netstat, ss, nmap, dig, ping, traceroute)", "description": "Network diagnostics and data transfer: curl/wget (HTTP), netstat/ss (socket stats), nmap (port scanning), dig (DNS), ping/traceroute (connectivity).", "summary": "Unix networking commands with purpose, common usage, important options and notes: curl, wget, ss, netstat, nmap, dig, ping and traceroute.", "use_when": [ "You are diagnosing connectivity, DNS or open ports from the command line.", "You need the right tool and flags for a network task." ], "caveats": [ "Scanning networks you do not own or have permission to test may be illegal; use nmap only on authorized systems.", "netstat is largely replaced by ss on modern Linux." ], "related": [ "network-ports-reference", "dns-fundamentals", "http-request-headers", "network-security-devices" ], "category": "Unix Commands", "category_slug": "unix-commands", "tags": "unix,linux,networking,curl,wget,dns,ports", "view_count": 0, "created_at": 1777673262, "updated_at": 1777673262, "entry_count": 8, "fields": [ { "section": "commands", "field": "name", "type": "string", "example": "curl" }, { "section": "commands", "field": "purpose", "type": "string", "example": "Transfer data from or to a server using various…" }, { "section": "commands", "field": "common_usage", "type": "string", "example": "curl [options] " }, { "section": "commands", "field": "important_options", "type": "array", "example": "[12 items]" }, { "section": "commands", "field": "example_output_type", "type": "string", "example": "HTTP response body, headers, or status code (wi…" }, { "section": "commands", "field": "related_commands", "type": "array", "example": "[3 items]" }, { "section": "commands", "field": "notes", "type": "string", "example": "curl doesn't follow redirects by default (-L). …" } ] }, "data": { "commands": [ { "name": "curl", "purpose": "Transfer data from or to a server using various protocols (HTTP, HTTPS, FTP, SCP, SFTP, etc.)", "common_usage": "curl [options] ", "important_options": [ { "-X ": "Specify HTTP method (GET, POST, PUT, DELETE)" }, { "-H
": "Add custom header" }, { "-d ": "HTTP POST data (application/x-www-form-urlencoded)" }, { "--data-binary ": "POST binary data from file" }, { "-o ": "Write output to file" }, { "-O": "Save output with remote filename" }, { "-L": "Follow redirects" }, { "-v": "Verbose (show request/response headers)" }, { "-s": "Silent mode (no progress)" }, { "-k": "Allow insecure SSL connections" }, { "-u ": "Basic authentication" }, { "-I": "Fetch headers only (HEAD request)" } ], "example_output_type": "HTTP response body, headers, or status code (with -w)", "related_commands": [ "wget", "httpie", "aria2" ], "notes": "curl doesn't follow redirects by default (-L). Use -w '%{http_code}' to capture status. Supports multi-part uploads (-F). Can send multiple requests with --next. Extremely scriptable for API testing." }, { "name": "wget", "purpose": "Non-interactive network downloader. Retrieves files via HTTP, HTTPS, FTP.", "common_usage": "wget [options] ", "important_options": [ { "-O ": "Output to specific filename (or - for stdout)" }, { "-P ": "Save to directory" }, { "-r": "Recursive download (crawl)" }, { "-np": "No parent (stay within directory hierarchy)" }, { "-N": "Timestamp-check only download newer files" }, { "-c": "Continue partial downloads" }, { "-q": "Quiet output" }, { "-nv": "Non-verbose but show errors" }, { "--limit-rate ": "Throttle download speed" }, { "--no-check-certificate": "Ignore SSL cert errors" } ], "example_output_type": "File saved to disk, progress bar on stderr", "related_commands": [ "curl", "aria2c", "axel" ], "notes": "wget is recursive by design (good for mirroring). -c resumable downloads work only if server supports Range header. Good for cron jobs (non-interactive). Can download multiple URLs from file via -i. Lacks curl's protocol variety." }, { "name": "ss (Socket Statistics)", "purpose": "Investigate network sockets and connections. Modern replacement for netstat (faster, more detailed).", "common_usage": "ss [options] [filter]", "important_options": [ { "-t": "TCP sockets" }, { "-u": "UDP sockets" }, { "-l": "Listening sockets only" }, { "-a": "All sockets (listening + established)" }, { "-n": "Numeric output (don't resolve names)" }, { "-p": "Show process using socket" }, { "-i": "Show internal information" }, { "-s": "Summary statistics" }, { "-e": "Extended socket info (timers, marks)" }, { "-m": "Show memory usage" }, { "-4/-6": "IPv4/IPv6 only" } ], "example_output_type": "Table: Netid, State, Recv-Q, Send-Q, Local Address:Port, Peer Address:Port, Process", "related_commands": [ "netstat", "lsof -i", "ip", "nmap" ], "notes": "ss reads directly from kernel via netlink (faster than netstat's /proc parsing). Filters: state = (established, listen, etc.), dport = :80, src 192.168.1.1. -p requires root for other users' processes. Essential for diagnosing connections and listening ports." }, { "name": "netstat", "purpose": "Display network connections, routing tables, interface stats, masquerade connections, and multicast memberships.", "common_usage": "netstat [options]", "important_options": [ { "-a": "All sockets (listening + non-listening)" }, { "-t": "TCP connections" }, { "-u": "UDP connections" }, { "-l": "Listening sockets only" }, { "-p": "Show PID/Program name (requires sudo)" }, { "-n": "Numeric output (no DNS resolution)" }, { "-r": "Routing table" }, { "-i": "Interface statistics" }, { "-s": "Protocol statistics" }, { "-c": "Continuous update (like top)" }, { "-e": "Extended info (TCP states, etc.)" } ], "example_output_type": "Table: Proto, Recv-Q, Send-Q, Local Address, Foreign Address, State, PID/Program name", "related_commands": [ "ss", "lsof", "ip", "ifconfig" ], "notes": "netstat is deprecated in favor of ss and ip. Still ubiquitous. -anp shows all connections with processes. Routing table: netstat -rn. Interface stats: netstat -i. Use -s to see packet loss/errors per protocol. Can be slow on systems with many connections." }, { "name": "nmap", "purpose": "Network exploration and security auditing. Port scanning, service detection, OS fingerprinting.", "common_usage": "nmap [options] ", "important_options": [ { "-sS": "TCP SYN scan (stealth, requires root)" }, { "-sT": "TCP connect scan (no root)" }, { "-sU": "UDP scan (slow)" }, { "-sV": "Version detection (service/version info)" }, { "-O": "OS detection" }, { "-A": "Aggressive: OS + version + script + traceroute" }, { "-p ": "Port range (e.g., -p 1-1000, -p 80,443)" }, { "-Pn": "Treat all hosts as online (skip ping)" }, { "-T<0-5>": "Timing template (0=paranoid, 5=insane)" }, { "-oN/-oX/-oG": "Output to normal/ XML/ grepable" }, { "--script ": "Run NSE scripts (vuln, discovery)" } ], "example_output_type": "Port table: PORT, STATE (open/closed/filtered), SERVICE, VERSION", "related_commands": [ "masscan", "hping3", "netcat", "dig" ], "notes": "Scanning requires authorization. SYN scan (-sS) is stealthy but needs root. States: open (listening), closed (not listening), filtered (firewall). -p- scans all 65535 ports (slow). Version detection (-sV) helps identify services. NSE scripts automate vulnerability checks." }, { "name": "dig (Domain Information Groper)", "purpose": "DNS lookup utility. Query DNS servers for resource records. Powerful debugging tool for DNS issues.", "common_usage": "dig [@server] []", "important_options": [ { "-t ": "Query record type (A, AAAA, MX, NS, TXT, CNAME, SOA, ANY)" }, { "@": "Query specific DNS server (default: /etc/resolv.conf)" }, { "+short": "Brief output (just answer)" }, { "+trace": "Trace resolution from root servers" }, { "+dnssec": "Request DNSSEC records (DNSKEY, RRSIG)" }, { "+multiline": "Wrap long records nicely" }, { "-x ": "Reverse lookup (PTR)" }, { "-p ": "Query non-standard port" }, { "+noall +answer": "Show only answer section" } ], "example_output_type": "DNS response sections: ANSWER (records), AUTHORITY (NS records), ADDITIONAL (glue), STATUS (NOERROR/NXDOMAIN)", "related_commands": [ "nslookup", "host", "whois" ], "notes": "dig output shows header, question, answer, authority, additional sections. +short for quick checks. Use dig +trace to see full delegation chain. Reverse: dig -x 8.8.8.8. Compare answers from multiple servers by changing @1.1.1.1, @8.8.8.8." }, { "name": "ping", "purpose": "Test network reachability and round-trip time (RTT) using ICMP echo requests.", "common_usage": "ping [options] ", "important_options": [ { "-c ": "Send only N packets (stop after N)" }, { "-i ": "Wait N seconds between pings (default 1s)" }, { "-W ": "Time to wait for response (seconds)" }, { "-w ": "Total time to run (seconds)" }, { "-s ": "Packet size (payload, default 56)" }, { "-q": "Quiet output (summary only)" }, { "-f": "Flood ping (requires root, rapid fire)" }, { "-I ": "Source interface/address" } ], "example_output_type": "Lines: 64 bytes from host: icmp_seq=N ttl=64 time=XX.X ms, plus summary statistics", "related_commands": [ "traceroute", "mtr", "ping6", "fping" ], "notes": "Measures latency and packet loss. ICMP may be blocked by firewalls. Standard ping packet: 56 bytes data + 8 bytes ICMP header = 64 bytes total. Use ping -c 4 google.com for quick check. -f flood can be used for DoS testing (ethically only on your own network)." }, { "name": "traceroute", "purpose": "Trace network path to destination, showing each hop (router) and round-trip time. Uses TTL expiration (ICMP Time Exceeded).", "common_usage": "traceroute [options] ", "important_options": [ { "-m ": "Maximum number of hops (default 30)" }, { "-n": "Numeric output (no DNS lookups)" }, { "-w ": "Wait time per probe (seconds)" }, { "-q ": "Probes per hop (default 3)" }, { "-I": "Use ICMP echo instead of UDP" }, { "-T": "Use TCP SYN packets (port 80)" }, { "-p ": "Destination port for UDP/TCP probes" }, { "-f": "First TTL (start from this hop)" } ], "example_output_type": "Lines: hop_number host_name (IP) probe1_ms probe2_ms probe3_ms [* = timeout]", "related_commands": [ "mtr", "tracepath", "ping" ], "notes": "Shows path and latency per hop. Each hop decrements TTL; TTL=0 returns ICMP Time Exceeded. Some routers block ICMP, showing * (but path still exists). Use traceroute -I if UDP blocked. mtr combines traceroute + ping for continuous monitoring." } ] } }