Linux CLI 31🐧 ip and netstat commands
ip address
ip link
ip neighbour
netstat -nr
netstat -tna | grep :25
ip and netstat are two essential tools for inspecting and managing network configuration on Linux. The ip command is the modern replacement for the older ifconfig, route, and arp commands. netstat shows active connections, listening ports, and routing tables — though it’s being gradually replaced by ss on newer systems.
Key point: ip is the current standard — it comes with every modern Linux distribution. netstat is still widely used but may need to be installed separately (net-tools package) on newer distros.
a – ip command
The ip command is a tool for managing network tasks. It can display, configure, and modify network interfaces, routes, addresses, and more. It uses an object syntax — you specify what you want to work with, then the action.
Basic syntax:
ip [OPTIONS] OBJECT {COMMAND | help}
| Command | Description |
|---|---|
ip address | Displays detailed information about all network interfaces |
ip link | Displays link layer information |
ip link -s | Displays link layer statistics |
ip neighbour | Lists devices in the same network (ARP/NDISC cache) |
ip route | Displays the routing table |
Other objects:
| Object | Purpose |
|---|---|
neighbour | ARP or NDISC cache entry |
rule | Rule in routing policy database |
tunnel | Tunnel over IP |
maddress | Multicast address |
Examples:
# Show all addresses on all interfaces
$ ip address
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic eth0
valid_lft 86394sec preferred_lft 86394sec
inet6 fe80::5054:ff:fe12:3456/64 scope link
valid_lft forever preferred_lft forever
3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 9c:ef:d5:12:34:56 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.101/24 brd 192.168.1.255 scope global dynamic wlan0
valid_lft 86394sec preferred_lft 86394sec
# Short form
$ ip a
...
# Show only link layer information
$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether 9c:ef:d5:12:34:56 brd ff:ff:ff:ff:ff:ff
# Show link layer statistics
$ ip link -s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
RX: bytes packets errors dropped missed mcast
123456789 123456 0 0 0 0
TX: bytes packets errors dropped carrier collsns
123456789 123456 0 0 0 0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped missed mcast
987654321 987654 0 0 0 123
TX: bytes packets errors dropped carrier collsns
123456789 123456 0 0 0 0
# List neighbours (ARP cache)
$ ip neighbour
192.168.1.1 dev eth0 lladdr 52:54:00:ab:cd:ef REACHABLE
192.168.1.50 dev eth0 lladdr 9c:ef:d5:aa:bb:cc STALE
192.168.1.75 dev wlan0 lladdr 00:11:22:33:44:55 REACHABLE
# Short form
$ ip n
# Show the routing table
$ ip route
default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.100 metric 100
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100
192.168.1.0/24 dev wlan0 proto kernel scope link src 192.168.1.101 metric 600
Reading ip address output:
| Field | Meaning |
|---|---|
1:, 2:, 3: | Interface index |
lo, eth0, wlan0 | Interface name |
UP, DOWN | Administrative state |
LOWER_UP | Physical link is up |
mtu 1500 | Maximum Transmission Unit |
link/ether | MAC address |
inet 192.168.1.100/24 | IPv4 address and prefix |
inet6 fe80::... | IPv6 address |
scope global | Address is globally routable |
scope link | Address is link-local |
valid_lft | How long the address is valid |
b – ip command examples
The ip command can modify network configuration, not just display it. This is where it replaces the older ifconfig and route commands.
| Command | Description |
|---|---|
ip addr add 192.168.1.2/24 dev eth0 | Sets a specific IP and subnet mask on eth0 |
ip route add default via 192.168.1.1 dev eth0 | Sets a new default gateway |
ip addr del 192.168.1.100/24 dev eth0 | Deletes a specific IP address |
sudo ip route flush | Flushes routing tables |
sudo ip neighbour flush | Flushes neighbour entries |
ip rule show | Shows IP rules |
ip rule add priority 1000 from 192.168.1.0/24 to 10.0.0.0/8 table main | Adds a new rule |
Examples:
# Add an IP address to an interface
$ sudo ip addr add 192.168.1.2/24 dev eth0
$ ip addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic eth0
inet 192.168.1.2/24 scope global secondary eth0
valid_lft forever preferred_lft forever
# Delete an IP address
$ sudo ip addr del 192.168.1.100/24 dev eth0
$ ip addr show eth0
2: eth0: ...
inet 192.168.1.2/24 scope global secondary eth0
# Bring an interface up
$ sudo ip link set eth0 up
# Bring an interface down
$ sudo ip link set eth0 down
# Set the default gateway
$ sudo ip route add default via 192.168.1.1 dev eth0
$ ip route
default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.2
# Add a specific route
$ sudo ip route add 10.0.0.0/8 via 192.168.1.254 dev eth0
# Delete a route
$ sudo ip route del 10.0.0.0/8
# Flush all routes (careful — can disconnect you!)
$ sudo ip route flush
# Flush the ARP cache
$ sudo ip neighbour flush all
# Show routing rules
$ ip rule show
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
# Add a routing rule
$ sudo ip rule add priority 1000 from 192.168.1.0/24 to 10.0.0.0/8 table main
# Show all addresses in short form
$ ip -br addr
lo UNKNOWN 127.0.0.1/8 ::1/128
eth0 UP 192.168.1.2/24 fe80::5054:ff:fe12:3456/64
wlan0 UP 192.168.1.101/24 fe80::9eef:d5ff:fe12:3456/64
Warning: Changing routes and addresses on a remote system (over SSH) can instantly disconnect you. Always test on a local console first, or use
at/screen/tmuxto schedule changes that revert.
c – netstat command
netstat displays network-related statistics and connections. It provides various options to filter, sort, display, or modify network-related data. It’s part of the net-tools package, which is older but still present on many systems.
| Command | Description |
|---|---|
netstat -tulpn | Shows all listening (LISTEN) TCP connections |
netstat -nr | Shows the routing table |
netstat -tna | grep :25 | Checks network connections on a specific port |
sudo netstat -tcp | Lists all established TCP connections |
sudo netstat --statistics | Shows network statistics |
netstat -au | Lists all UDP ports |
netstat -l | Lists all listening ports |
Examples:
# Show all listening TCP connections with process info
$ sudo netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1234/cupsd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 5678/sshd
tcp6 0 0 :::80 :::* LISTEN 9012/apache2
udp 0 0 0.0.0.0:68 0.0.0.0:* 3456/dhclient
udp 0 0 127.0.0.1:323 0.0.0.0:* 7890/chronyd
# Show the routing table
$ netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
# Check connections on a specific port
$ netstat -tna | grep :25
tcp 0 0 192.168.1.100:25 192.168.1.50:54321 ESTABLISHED
tcp 0 0 192.168.1.100:25 192.168.1.75:43210 ESTABLISHED
# List established TCP connections
$ sudo netstat -tcp
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 192.168.1.100:22 192.168.1.50:54321 ESTABLISHED
tcp 0 0 192.168.1.100:443 142.250.185.78:51234 ESTABLISHED
# Show network statistics
$ sudo netstat --statistics
Ip:
1234567 total packets received
0 forwarded
0 incoming packets discarded
1234000 incoming packets delivered
987654 requests sent out
Icmp:
123 ICMP messages received
0 input ICMP message failed
...
# List all UDP ports
$ netstat -au
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
udp 0 0 0.0.0.0:68 0.0.0.0:*
udp 0 0 127.0.0.1:323 0.0.0.0:*
udp6 0 0 :::546 :::*
# List all listening ports
$ netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp6 0 0 :::80 :::* LISTEN
udp 0 0 0.0.0.0:68 0.0.0.0:*
udp 0 0 127.0.0.1:323 0.0.0.0:*
Reading netstat output:
| Field | Meaning |
|---|---|
Proto | Protocol — tcp, udp, tcp6 |
Recv-Q | Bytes waiting to be received |
Send-Q | Bytes waiting to be sent |
Local Address | Your side of the connection (IP:port) |
Foreign Address | The other side (IP:port) |
State | LISTEN, ESTABLISHED, TIME_WAIT, etc. |
PID/Program name | Process owning the socket |
Common flags explained:
| Flag | Meaning |
|---|---|
-t | TCP |
-u | UDP |
-l | Listening |
-n | Numeric (no DNS) |
-p | Show process |
-a | All |
-r | Routing table |
-c | Continuous output |
Note: On modern systems,
sshas largely replacednetstat. It’s faster and provides the same information. Tryss -tulpninstead ofnetstat -tulpn.
Complete Example Session
# ============================================
# PART 1: INSPECT INTERFACES WITH IP
# ============================================
$ ip address
1: lo: <LOOPBACK,UP,LOWER_UP> ...
inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic eth0
$ ip -br addr
lo UNKNOWN 127.0.0.1/8 ::1/128
eth0 UP 192.168.1.100/24 fe80::5054:ff:fe12:3456/64
# ============================================
# PART 2: LINK LAYER
# ============================================
$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> ...
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
$ ip link -s
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
RX: bytes packets errors dropped missed mcast
987654321 987654 0 0 0 123
TX: bytes packets errors dropped carrier collsns
123456789 123456 0 0 0 0
# ============================================
# PART 3: NEIGHBOURS AND ROUTES
# ============================================
$ ip neighbour
192.168.1.1 dev eth0 lladdr 52:54:00:ab:cd:ef REACHABLE
192.168.1.50 dev eth0 lladdr 9c:ef:d5:aa:bb:cc STALE
$ ip route
default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.100 metric 100
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100
# ============================================
# PART 4: MODIFY NETWORK WITH IP
# ============================================
# Add an IP
$ sudo ip addr add 192.168.1.2/24 dev eth0
# Delete an IP
$ sudo ip addr del 192.168.1.100/24 dev eth0
# Set default gateway
$ sudo ip route add default via 192.168.1.1 dev eth0
# Flush neighbours
$ sudo ip neighbour flush all
# ============================================
# PART 5: NETSTAT — LISTENING PORTS
# ============================================
$ sudo netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1234/cupsd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 5678/sshd
tcp6 0 0 :::80 :::* LISTEN 9012/apache2
udp 0 0 0.0.0.0:68 0.0.0.0:* 3456/dhclient
# ============================================
# PART 6: NETSTAT — ROUTING
# ============================================
$ netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
# ============================================
# PART 7: NETSTAT — SPECIFIC PORT
# ============================================
$ netstat -tna | grep :25
tcp 0 0 192.168.1.100:25 192.168.1.50:54321 ESTABLISHED
tcp 0 0 192.168.1.100:25 192.168.1.75:43210 ESTABLISHED
# ============================================
# PART 8: NETSTAT — STATISTICS
# ============================================
$ sudo netstat --statistics
Ip:
1234567 total packets received
0 forwarded
...
Quick Reference
ip — Display
| Command | Purpose |
|---|---|
ip address | Show all addresses |
ip -br addr | Brief address list |
ip link | Show link layer |
ip link -s | Link statistics |
ip neighbour | ARP/NDISC cache |
ip route | Routing table |
ip rule show | Routing rules |
ip — Modify
| Command | Purpose |
|---|---|
ip addr add IP/MASK dev IFACE | Add an IP |
ip addr del IP/MASK dev IFACE | Delete an IP |
ip link set IFACE up | Bring interface up |
ip link set IFACE down | Bring interface down |
ip route add default via GW dev IFACE | Set default gateway |
ip route add NET via GW dev IFACE | Add a route |
ip route del NET | Delete a route |
ip route flush | Flush routing tables |
ip neighbour flush | Flush ARP cache |
ip rule add ... | Add a routing rule |
netstat
| Command | Purpose |
|---|---|
netstat -tulpn | Listening TCP ports + processes |
netstat -nr | Routing table |
netstat -tna | All TCP connections |
netstat -au | All UDP ports |
netstat -l | All listening ports |
netstat -tcp | Established TCP connections |
netstat --statistics | Network statistics |
netstat -tna | grep :25 | Filter by port |
netstat Flags
| Flag | Meaning |
|---|---|
-t | TCP |
-u | UDP |
-l | Listening |
-n | Numeric (no DNS) |
-p | Show process |
-a | All |
-r | Routing |
-c | Continuous |
Best Practices
✅ Do This:
# Use ip instead of ifconfig/route/arp
ip address # ✅ modern
ip route # ✅ modern
# Use -br for readable output
ip -br addr # ✅
# Use -n to skip DNS (faster)
netstat -tuln # ✅
ip -n route # ✅
# Use sudo for process info
sudo netstat -tulpn # ✅
# Filter with grep for specific ports
netstat -tna | grep :22 # ✅
# Prefer ss on modern systems
ss -tulpn # ✅ (faster)
❌ Don’t Do This:
# Don't use ifconfig/route/arp (deprecated)
ifconfig # ❌ old
route -n # ❌ old
arp -a # ❌ old
# Don't modify routes over SSH without care
sudo ip route flush # ❌ disconnects you
# Don't run netstat without sudo for -p
netstat -tulpn # ❌ no process info
# Don't forget -n (DNS is slow)
netstat -tulpn # ❌ slow without -n
# Don't confuse ip addr with ip route
ip addr # ❌ for addresses
ip route # ✅ for routes
Common Pitfalls
| Pitfall | Problem | Solution |
|---|---|---|
netstat: command not found | Not installed | sudo apt install net-tools |
| No PID shown | Forgot sudo | Use sudo netstat -tulpn |
| Slow output | DNS lookups | Add -n |
| SSH disconnect | Changed route remotely | Use console or screen |
| Wrong interface | Typo in name | Check with ip link |
ip addr shows DOWN | Interface not up | sudo ip link set IFACE up |
| ARP cache stale | Old entries | sudo ip neighbour flush |
-p doesn’t work | Non-root | Prefix with sudo |
Real-World Examples
1. Show All IP Addresses
$ ip -br addr
lo UNKNOWN 127.0.0.1/8 ::1/128
eth0 UP 192.168.1.100/24 fe80::5054:ff:fe12:3456/64
wlan0 UP 192.168.1.101/24 fe80::9eef:d5ff:fe12:3456/64
2. Find Your Default Gateway
$ ip route | grep default
default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.100 metric 100
3. Check the ARP Cache
$ ip neighbour
192.168.1.1 dev eth0 lladdr 52:54:00:ab:cd:ef REACHABLE
192.168.1.50 dev eth0 lladdr 9c:ef:d5:aa:bb:cc STALE
4. Add a Temporary IP
$ sudo ip addr add 192.168.1.200/24 dev eth0
$ ip -br addr show eth0
eth0 UP 192.168.1.100/24 192.168.1.200/24
5. Find Who’s Listening on Port 80
$ sudo netstat -tulpn | grep :80
tcp6 0 0 :::80 :::* LISTEN 9012/apache2
6. Show Active Connections to Port 22
$ netstat -tna | grep :22
tcp 0 0 192.168.1.100:22 192.168.1.50:54321 ESTABLISHED
tcp 0 0 192.168.1.100:22 192.168.1.75:43210 ESTABLISHED
7. View the Routing Table
$ netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
8. Check Interface Statistics
$ ip -s link show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped missed mcast
987654321 987654 0 0 0 123
TX: bytes packets errors dropped carrier collsns
123456789 123456 0 0 0 0
9. Flush ARP Cache
$ sudo ip neighbour flush all
$ ip neighbour
# (empty — cache cleared)
10. Modern Alternative — ss
$ ss -tulpn
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
tcp LISTEN 0 128 127.0.0.1:631 0.0.0.0:* users:(("cupsd",pid=1234,fd=7))
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=5678,fd=3))
tcp LISTEN 0 511 *:80 *:* users:(("apache2",pid=9012,fd=4))
udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:* users:(("dhclient",pid=3456,fd=6))
Visual: The Network Stack
┌──────────────────────────────────────────────┐
│ Application │
│ (browser, ssh, curl, ...) │
└─────────────────┬────────────────────────────┘
│
▼
┌──────────────────────────────────────────────┐
│ Transport Layer (TCP/UDP) │
│ │
│ netstat -t → TCP connections │
│ netstat -u → UDP connections │
│ ss -tulpn → modern alternative │
└─────────────────┬────────────────────────────┘
│
▼
┌──────────────────────────────────────────────┐
│ Network Layer (IP) │
│ │
│ ip address → IP addresses │
│ ip route → routing table │
│ ip rule → routing policy │
└─────────────────┬────────────────────────────┘
│
▼
┌──────────────────────────────────────────────┐
│ Link Layer (Ethernet/WiFi) │
│ │
│ ip link → MAC, MTU, state │
│ ip neighbour → ARP/NDISC cache │
└──────────────────────────────────────────────┘
Summary
| Command | Purpose | Example |
|---|---|---|
ip address | Show all interfaces | ip address |
ip -br addr | Brief address list | ip -br addr |
ip link | Link layer info | ip link |
ip link -s | Link statistics | ip link -s |
ip neighbour | ARP cache | ip neighbour |
ip route | Routing table | ip route |
ip rule show | Routing rules | ip rule show |
ip addr add | Add an IP | ip addr add 192.168.1.2/24 dev eth0 |
ip addr del | Delete an IP | ip addr del 192.168.1.100/24 dev eth0 |
ip route add | Add a route | ip route add default via 192.168.1.1 dev eth0 |
ip route flush | Flush routes | sudo ip route flush |
ip neighbour flush | Flush ARP | sudo ip neighbour flush |
netstat -tulpn | Listening ports + PID | sudo netstat -tulpn |
netstat -nr | Routing table | netstat -nr |
netstat -tna | All TCP connections | netstat -tna |
netstat -au | All UDP ports | netstat -au |
netstat -l | All listening | netstat -l |
netstat --statistics | Network stats | sudo netstat --statistics |
Key takeaways:
ipis the modern tool — it replacesifconfig,route, andarp- Use
ip addressfor IPs,ip linkfor MAC/MTU,ip neighbourfor ARP,ip routefor routes - Use
ip -brfor compact, readable output netstatshows connections, listening ports, and routing — butssis the modern replacement- Common netstat flags:
-tTCP,-uUDP,-llistening,-nnumeric,-pprocess - Use
sudowith-pto see process names - Use
grep :PORTto filter specific ports - Be careful modifying routes over SSH — you can disconnect yourself
Remember: ip is the present and future — learn it well. netstat still works everywhere but is being phased out in favor of ss. Use ip -br addr for a quick address list, ip route to find your gateway, ip neighbour to inspect ARP, and netstat -tulpn (or ss -tulpn) to see who’s listening on what. Master these tools, and you can inspect and control every layer of your network from the command line.
Stop using slow, ad-bloated tool sites! 🤮
🔎 Search “KandZ Tools” on Google to use many professional utilities for free.
KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)
⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free
🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!