Network Commands

The Network Toolbox

When something is wrong on a machine or a network, a handful of commands answer most questions: Is it reachable? What is it listening on? Who is it talking to? What does the web server say about itself? You will use these daily as a security analyst.

ping: Is It Reachable?

ping -c 4 google.com

ping sends ICMP echo requests and measures the reply time. It tells you the host is alive, the latency, and the packet loss. Many firewalls block ICMP, so no reply does not always mean down.

traceroute: Where Does the Traffic Go?

traceroute scanme.nmap.org

traceroute uses the TTL trick from the networking module. It sends packets with TTL 1, 2, 3, and so on, and each router that drops one reveals itself. You see every hop and its delay. A sudden jump (for example from 14 ms to 98 ms) shows where the traffic crosses an ocean, such as from Lagos to a European exchange. Unexpected hops can indicate a routing problem or a redirect.

ss and netstat: What Is Listening?

ss -tulnp          # TCP + UDP, listening, numeric, with process
netstat -tulnp     # older tool, similar output

Flags: t TCP, u UDP, l listening, n numbers not names, p show the process.

tcp  LISTEN  0.0.0.0:22       sshd    (expected)
tcp  LISTEN  127.0.0.1:3306   mysqld  (local only: good)
tcp  LISTEN  0.0.0.0:4444     nc      (why?)

Notice the address. 127.0.0.1 means only this machine can connect. 0.0.0.0 means every network interface, so anyone who can reach the server can connect. A database on 0.0.0.0 is a finding. Use ss -tunap to also see established connections and spot a strange outbound one.

curl and wget: Talk to Web Servers

curl http://target.lab            # fetch the page
curl -I http://target.lab         # headers only
wget http://target.lab/file.zip   # download a file

curl -I is a security favourite. Read the headers:

Server: Apache/2.2.8 (Ubuntu) DAV/2      <- exact version leaks
X-Powered-By: PHP/5.2.4                  <- exact version leaks
(missing) Strict-Transport-Security
(missing) X-Frame-Options
(missing) Content-Security-Policy

Old version numbers help an attacker pick an exploit, and missing headers are quick findings for a report. In Module 4 you will learn what these headers do.

Careful: never run curl ... | bash on a script you have not read. Attackers use that pattern to install malware.

Putting It Together: A Quick Triage

Suppose a colleague says a server "feels suspicious". A sensible first five minutes:

1. ss -tulnp: what is listening, and is it expected?
2. ps aux: any unexpected processes?
3. ping and traceroute: is the network path sane?
4. curl -I on your own web service: what does it reveal?
5. Compare everything against what should be there (a baseline).

Finding a difference between "expected" and "actual" is the core skill of both defenders and penetration testers.

A Nigerian and Global View

Whether you support a bank's internal apps in Lagos, a telecom in Accra or a SaaS startup in Berlin, these same commands work on every Linux server and cloud instance. Being fluent with them makes you faster in interviews, in incident response and in bug-bounty work.

Try It in the Lab: Network Reconnaissance

You are cleared to assess the staging server target.lab (192.168.56.101) on the lab network. Complete the mission in the simulated terminal on the right:

1. ifconfig (or ip a): what is this machine's IP address and subnet?
2. ping -c 3 target.lab: is the target up? How fast does it answer?
3. traceroute scanme.nmap.org: count the hops. Which one looks like the Lagos internet exchange, and where does the latency jump?
4. netstat -tulnp (or ss -tulnp): which ports is your machine listening on, and which process owns each one? One of them should not be there.
5. curl: fetch http://target.lab/robots.txt and follow it to the page the admins tried to hide.

Bonus: dig target.lab to see how the name resolves. Also run curl -I http://target.lab and list the headers that leak software versions.

Everything here is simulated and safe. Only run scans and fetches against systems you own or are allowed to test.