|

Linux CLI 31🐧 ip and netstat commands

ip address
ip link
ip neighbour
netstat -nr
netstat -tna | grep :25

ip and netstat are two essential tools for inspecting and managing network configuration on Linux. The ip command is the modern replacement for the older ifconfig, route, and arp commands. netstat shows active connections, listening ports, and routing tables — though it’s being gradually replaced by ss on newer systems.

Key point: ip is the current standard — it comes with every modern Linux distribution. netstat is still widely used but may need to be installed separately (net-tools package) on newer distros.


a – ip command

The ip command is a tool for managing network tasks. It can display, configure, and modify network interfaces, routes, addresses, and more. It uses an object syntax — you specify what you want to work with, then the action.

Basic syntax:

ip [OPTIONS] OBJECT {COMMAND | help}
CommandDescription
ip addressDisplays detailed information about all network interfaces
ip linkDisplays link layer information
ip link -sDisplays link layer statistics
ip neighbourLists devices in the same network (ARP/NDISC cache)
ip routeDisplays the routing table

Other objects:

ObjectPurpose
neighbourARP or NDISC cache entry
ruleRule in routing policy database
tunnelTunnel over IP
maddressMulticast address

Examples:

# Show all addresses on all interfaces
$ ip address
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic eth0
       valid_lft 86394sec preferred_lft 86394sec
    inet6 fe80::5054:ff:fe12:3456/64 scope link
       valid_lft forever preferred_lft forever
3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 9c:ef:d5:12:34:56 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.101/24 brd 192.168.1.255 scope global dynamic wlan0
       valid_lft 86394sec preferred_lft 86394sec

# Short form
$ ip a
...

# Show only link layer information
$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether 9c:ef:d5:12:34:56 brd ff:ff:ff:ff:ff:ff

# Show link layer statistics
$ ip link -s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    RX: bytes  packets  errors  dropped missed  mcast
    123456789  123456   0       0       0       0
    TX: bytes  packets  errors  dropped carrier collsns
    123456789  123456   0       0       0       0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped missed  mcast
    987654321  987654   0       0       0       123
    TX: bytes  packets  errors  dropped carrier collsns
    123456789  123456   0       0       0       0

# List neighbours (ARP cache)
$ ip neighbour
192.168.1.1 dev eth0 lladdr 52:54:00:ab:cd:ef REACHABLE
192.168.1.50 dev eth0 lladdr 9c:ef:d5:aa:bb:cc STALE
192.168.1.75 dev wlan0 lladdr 00:11:22:33:44:55 REACHABLE

# Short form
$ ip n

# Show the routing table
$ ip route
default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.100 metric 100
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100
192.168.1.0/24 dev wlan0 proto kernel scope link src 192.168.1.101 metric 600

Reading ip address output:

FieldMeaning
1:, 2:, 3:Interface index
lo, eth0, wlan0Interface name
UP, DOWNAdministrative state
LOWER_UPPhysical link is up
mtu 1500Maximum Transmission Unit
link/etherMAC address
inet 192.168.1.100/24IPv4 address and prefix
inet6 fe80::...IPv6 address
scope globalAddress is globally routable
scope linkAddress is link-local
valid_lftHow long the address is valid

b – ip command examples

The ip command can modify network configuration, not just display it. This is where it replaces the older ifconfig and route commands.

CommandDescription
ip addr add 192.168.1.2/24 dev eth0Sets a specific IP and subnet mask on eth0
ip route add default via 192.168.1.1 dev eth0Sets a new default gateway
ip addr del 192.168.1.100/24 dev eth0Deletes a specific IP address
sudo ip route flushFlushes routing tables
sudo ip neighbour flushFlushes neighbour entries
ip rule showShows IP rules
ip rule add priority 1000 from 192.168.1.0/24 to 10.0.0.0/8 table mainAdds a new rule

Examples:

# Add an IP address to an interface
$ sudo ip addr add 192.168.1.2/24 dev eth0
$ ip addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic eth0
    inet 192.168.1.2/24 scope global secondary eth0
       valid_lft forever preferred_lft forever

# Delete an IP address
$ sudo ip addr del 192.168.1.100/24 dev eth0
$ ip addr show eth0
2: eth0: ...
    inet 192.168.1.2/24 scope global secondary eth0

# Bring an interface up
$ sudo ip link set eth0 up

# Bring an interface down
$ sudo ip link set eth0 down

# Set the default gateway
$ sudo ip route add default via 192.168.1.1 dev eth0
$ ip route
default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.2

# Add a specific route
$ sudo ip route add 10.0.0.0/8 via 192.168.1.254 dev eth0

# Delete a route
$ sudo ip route del 10.0.0.0/8

# Flush all routes (careful — can disconnect you!)
$ sudo ip route flush

# Flush the ARP cache
$ sudo ip neighbour flush all

# Show routing rules
$ ip rule show
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default

# Add a routing rule
$ sudo ip rule add priority 1000 from 192.168.1.0/24 to 10.0.0.0/8 table main

# Show all addresses in short form
$ ip -br addr
lo               UNKNOWN        127.0.0.1/8 ::1/128
eth0             UP             192.168.1.2/24 fe80::5054:ff:fe12:3456/64
wlan0            UP             192.168.1.101/24 fe80::9eef:d5ff:fe12:3456/64

Warning: Changing routes and addresses on a remote system (over SSH) can instantly disconnect you. Always test on a local console first, or use at/screen/tmux to schedule changes that revert.


c – netstat command

netstat displays network-related statistics and connections. It provides various options to filter, sort, display, or modify network-related data. It’s part of the net-tools package, which is older but still present on many systems.

CommandDescription
netstat -tulpnShows all listening (LISTEN) TCP connections
netstat -nrShows the routing table
netstat -tna | grep :25Checks network connections on a specific port
sudo netstat -tcpLists all established TCP connections
sudo netstat --statisticsShows network statistics
netstat -auLists all UDP ports
netstat -lLists all listening ports

Examples:

# Show all listening TCP connections with process info
$ sudo netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      1234/cupsd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      5678/sshd
tcp6       0      0 :::80                   :::*                    LISTEN      9012/apache2
udp        0      0 0.0.0.0:68              0.0.0.0:*                           3456/dhclient
udp        0      0 127.0.0.1:323           0.0.0.0:*                           7890/chronyd

# Show the routing table
$ netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0

# Check connections on a specific port
$ netstat -tna | grep :25
tcp        0      0 192.168.1.100:25        192.168.1.50:54321      ESTABLISHED
tcp        0      0 192.168.1.100:25        192.168.1.75:43210      ESTABLISHED

# List established TCP connections
$ sudo netstat -tcp
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 192.168.1.100:22        192.168.1.50:54321      ESTABLISHED
tcp        0      0 192.168.1.100:443       142.250.185.78:51234    ESTABLISHED

# Show network statistics
$ sudo netstat --statistics
Ip:
    1234567 total packets received
    0 forwarded
    0 incoming packets discarded
    1234000 incoming packets delivered
    987654 requests sent out
Icmp:
    123 ICMP messages received
    0 input ICMP message failed
    ...

# List all UDP ports
$ netstat -au
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
udp        0      0 0.0.0.0:68              0.0.0.0:*
udp        0      0 127.0.0.1:323           0.0.0.0:*
udp6       0      0 :::546                  :::*

# List all listening ports
$ netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
tcp6       0      0 :::80                   :::*                    LISTEN
udp        0      0 0.0.0.0:68              0.0.0.0:*
udp        0      0 127.0.0.1:323           0.0.0.0:*

Reading netstat output:

FieldMeaning
ProtoProtocol — tcp, udp, tcp6
Recv-QBytes waiting to be received
Send-QBytes waiting to be sent
Local AddressYour side of the connection (IP:port)
Foreign AddressThe other side (IP:port)
StateLISTEN, ESTABLISHED, TIME_WAIT, etc.
PID/Program nameProcess owning the socket

Common flags explained:

FlagMeaning
-tTCP
-uUDP
-lListening
-nNumeric (no DNS)
-pShow process
-aAll
-rRouting table
-cContinuous output

Note: On modern systems, ss has largely replaced netstat. It’s faster and provides the same information. Try ss -tulpn instead of netstat -tulpn.


Complete Example Session

# ============================================
# PART 1: INSPECT INTERFACES WITH IP
# ============================================

$ ip address
1: lo: <LOOPBACK,UP,LOWER_UP> ...
    inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic eth0

$ ip -br addr
lo               UNKNOWN        127.0.0.1/8 ::1/128
eth0             UP             192.168.1.100/24 fe80::5054:ff:fe12:3456/64

# ============================================
# PART 2: LINK LAYER
# ============================================

$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> ...
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> ...

$ ip link -s
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
    RX: bytes  packets  errors  dropped missed  mcast
    987654321  987654   0       0       0       123
    TX: bytes  packets  errors  dropped carrier collsns
    123456789  123456   0       0       0       0

# ============================================
# PART 3: NEIGHBOURS AND ROUTES
# ============================================

$ ip neighbour
192.168.1.1 dev eth0 lladdr 52:54:00:ab:cd:ef REACHABLE
192.168.1.50 dev eth0 lladdr 9c:ef:d5:aa:bb:cc STALE

$ ip route
default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.100 metric 100
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100

# ============================================
# PART 4: MODIFY NETWORK WITH IP
# ============================================

# Add an IP
$ sudo ip addr add 192.168.1.2/24 dev eth0

# Delete an IP
$ sudo ip addr del 192.168.1.100/24 dev eth0

# Set default gateway
$ sudo ip route add default via 192.168.1.1 dev eth0

# Flush neighbours
$ sudo ip neighbour flush all

# ============================================
# PART 5: NETSTAT — LISTENING PORTS
# ============================================

$ sudo netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      1234/cupsd
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      5678/sshd
tcp6       0      0 :::80                   :::*                    LISTEN      9012/apache2
udp        0      0 0.0.0.0:68              0.0.0.0:*                           3456/dhclient

# ============================================
# PART 6: NETSTAT — ROUTING
# ============================================

$ netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0

# ============================================
# PART 7: NETSTAT — SPECIFIC PORT
# ============================================

$ netstat -tna | grep :25
tcp        0      0 192.168.1.100:25        192.168.1.50:54321      ESTABLISHED
tcp        0      0 192.168.1.100:25        192.168.1.75:43210      ESTABLISHED

# ============================================
# PART 8: NETSTAT — STATISTICS
# ============================================

$ sudo netstat --statistics
Ip:
    1234567 total packets received
    0 forwarded
    ...

Quick Reference

ip — Display

CommandPurpose
ip addressShow all addresses
ip -br addrBrief address list
ip linkShow link layer
ip link -sLink statistics
ip neighbourARP/NDISC cache
ip routeRouting table
ip rule showRouting rules

ip — Modify

CommandPurpose
ip addr add IP/MASK dev IFACEAdd an IP
ip addr del IP/MASK dev IFACEDelete an IP
ip link set IFACE upBring interface up
ip link set IFACE downBring interface down
ip route add default via GW dev IFACESet default gateway
ip route add NET via GW dev IFACEAdd a route
ip route del NETDelete a route
ip route flushFlush routing tables
ip neighbour flushFlush ARP cache
ip rule add ...Add a routing rule

netstat

CommandPurpose
netstat -tulpnListening TCP ports + processes
netstat -nrRouting table
netstat -tnaAll TCP connections
netstat -auAll UDP ports
netstat -lAll listening ports
netstat -tcpEstablished TCP connections
netstat --statisticsNetwork statistics
netstat -tna | grep :25Filter by port

netstat Flags

FlagMeaning
-tTCP
-uUDP
-lListening
-nNumeric (no DNS)
-pShow process
-aAll
-rRouting
-cContinuous

Best Practices

Do This:

# Use ip instead of ifconfig/route/arp
ip address                            # ✅ modern
ip route                              # ✅ modern

# Use -br for readable output
ip -br addr                           # ✅

# Use -n to skip DNS (faster)
netstat -tuln                         # ✅
ip -n route                           # ✅

# Use sudo for process info
sudo netstat -tulpn                   # ✅

# Filter with grep for specific ports
netstat -tna | grep :22               # ✅

# Prefer ss on modern systems
ss -tulpn                             # ✅ (faster)

Don’t Do This:

# Don't use ifconfig/route/arp (deprecated)
ifconfig                              # ❌ old
route -n                              # ❌ old
arp -a                                # ❌ old

# Don't modify routes over SSH without care
sudo ip route flush                   # ❌ disconnects you

# Don't run netstat without sudo for -p
netstat -tulpn                        # ❌ no process info

# Don't forget -n (DNS is slow)
netstat -tulpn                        # ❌ slow without -n

# Don't confuse ip addr with ip route
ip addr                               # ❌ for addresses
ip route                              # ✅ for routes

Common Pitfalls

PitfallProblemSolution
netstat: command not foundNot installedsudo apt install net-tools
No PID shownForgot sudoUse sudo netstat -tulpn
Slow outputDNS lookupsAdd -n
SSH disconnectChanged route remotelyUse console or screen
Wrong interfaceTypo in nameCheck with ip link
ip addr shows DOWNInterface not upsudo ip link set IFACE up
ARP cache staleOld entriessudo ip neighbour flush
-p doesn’t workNon-rootPrefix with sudo

Real-World Examples

1. Show All IP Addresses

$ ip -br addr
lo               UNKNOWN        127.0.0.1/8 ::1/128
eth0             UP             192.168.1.100/24 fe80::5054:ff:fe12:3456/64
wlan0            UP             192.168.1.101/24 fe80::9eef:d5ff:fe12:3456/64

2. Find Your Default Gateway

$ ip route | grep default
default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.100 metric 100

3. Check the ARP Cache

$ ip neighbour
192.168.1.1 dev eth0 lladdr 52:54:00:ab:cd:ef REACHABLE
192.168.1.50 dev eth0 lladdr 9c:ef:d5:aa:bb:cc STALE

4. Add a Temporary IP

$ sudo ip addr add 192.168.1.200/24 dev eth0
$ ip -br addr show eth0
eth0             UP             192.168.1.100/24 192.168.1.200/24

5. Find Who’s Listening on Port 80

$ sudo netstat -tulpn | grep :80
tcp6       0      0 :::80                   :::*                    LISTEN      9012/apache2

6. Show Active Connections to Port 22

$ netstat -tna | grep :22
tcp        0      0 192.168.1.100:22        192.168.1.50:54321      ESTABLISHED
tcp        0      0 192.168.1.100:22        192.168.1.75:43210      ESTABLISHED

7. View the Routing Table

$ netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0

8. Check Interface Statistics

$ ip -s link show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
    RX: bytes  packets  errors  dropped missed  mcast
    987654321  987654   0       0       0       123
    TX: bytes  packets  errors  dropped carrier collsns
    123456789  123456   0       0       0       0

9. Flush ARP Cache

$ sudo ip neighbour flush all
$ ip neighbour
# (empty — cache cleared)

10. Modern Alternative — ss

$ ss -tulpn
Netid  State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port  Process
tcp    LISTEN  0       128      127.0.0.1:631        0.0.0.0:*          users:(("cupsd",pid=1234,fd=7))
tcp    LISTEN  0       128      0.0.0.0:22           0.0.0.0:*          users:(("sshd",pid=5678,fd=3))
tcp    LISTEN  0       511      *:80                 *:*                users:(("apache2",pid=9012,fd=4))
udp    UNCONN  0       0        0.0.0.0:68           0.0.0.0:*          users:(("dhclient",pid=3456,fd=6))

Visual: The Network Stack

┌──────────────────────────────────────────────┐
│              Application                     │
│         (browser, ssh, curl, ...)            │
└─────────────────┬────────────────────────────┘
                  │
                  ▼
┌──────────────────────────────────────────────┐
│          Transport Layer (TCP/UDP)           │
│                                              │
│   netstat -t  → TCP connections              │
│   netstat -u  → UDP connections              │
│   ss -tulpn   → modern alternative           │
└─────────────────┬────────────────────────────┘
                  │
                  ▼
┌──────────────────────────────────────────────┐
│              Network Layer (IP)              │
│                                              │
│   ip address  → IP addresses                 │
│   ip route    → routing table                │
│   ip rule     → routing policy               │
└─────────────────┬────────────────────────────┘
                  │
                  ▼
┌──────────────────────────────────────────────┐
│           Link Layer (Ethernet/WiFi)         │
│                                              │
│   ip link      → MAC, MTU, state             │
│   ip neighbour → ARP/NDISC cache             │
└──────────────────────────────────────────────┘

Summary

CommandPurposeExample
ip addressShow all interfacesip address
ip -br addrBrief address listip -br addr
ip linkLink layer infoip link
ip link -sLink statisticsip link -s
ip neighbourARP cacheip neighbour
ip routeRouting tableip route
ip rule showRouting rulesip rule show
ip addr addAdd an IPip addr add 192.168.1.2/24 dev eth0
ip addr delDelete an IPip addr del 192.168.1.100/24 dev eth0
ip route addAdd a routeip route add default via 192.168.1.1 dev eth0
ip route flushFlush routessudo ip route flush
ip neighbour flushFlush ARPsudo ip neighbour flush
netstat -tulpnListening ports + PIDsudo netstat -tulpn
netstat -nrRouting tablenetstat -nr
netstat -tnaAll TCP connectionsnetstat -tna
netstat -auAll UDP portsnetstat -au
netstat -lAll listeningnetstat -l
netstat --statisticsNetwork statssudo netstat --statistics

Key takeaways:

  • ip is the modern tool — it replaces ifconfig, route, and arp
  • Use ip address for IPs, ip link for MAC/MTU, ip neighbour for ARP, ip route for routes
  • Use ip -br for compact, readable output
  • netstat shows connections, listening ports, and routing — but ss is the modern replacement
  • Common netstat flags: -t TCP, -u UDP, -l listening, -n numeric, -p process
  • Use sudo with -p to see process names
  • Use grep :PORT to filter specific ports
  • Be careful modifying routes over SSH — you can disconnect yourself

Remember: ip is the present and future — learn it well. netstat still works everywhere but is being phased out in favor of ss. Use ip -br addr for a quick address list, ip route to find your gateway, ip neighbour to inspect ARP, and netstat -tulpn (or ss -tulpn) to see who’s listening on what. Master these tools, and you can inspect and control every layer of your network from the command line.


Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!