Network Command Cheat Sheets
One practical page for common network checks. Pick a topic, run the smallest useful command set, then move to packet capture, logs, or config only when the first signals disagree.
Cisco Show Commands
Use these first to prove interface state, routes, neighbors, errors, and recent device events.
| Need | Command | How to read the output |
|---|---|---|
| Interface summary | show ip interface brief | Status is physical; Protocol is line protocol. up/down usually means Layer 2 or keepalive issue. |
| Interface detail | show interfaces Gi0/1 | Read input/output errors, CRC, drops, resets, bandwidth, duplex, speed, and last flap time. |
| Switch port state | show interfaces status | Shows connected/notconnect, VLAN, duplex, speed, and port type. Good first check for wrong VLAN or down cable. |
| Error counters | show interfaces counters errors | CRC/input errors suggest cable, optics, speed/duplex, or physical layer problems. |
| Device neighbors | show cdp neighbors detail | Confirms connected device name, platform, local interface, remote interface, and management IP. |
| LLDP neighbors | show lldp neighbors detail | Use when CDP is disabled or the neighbor is non-Cisco. |
| Routing table | show ip route | Look for route source, prefix, next hop, exit interface, metric, and route age. |
| Specific route | show ip route 10.10.10.10 | Shows the selected route for one destination. If missing, check default route or routing protocol. |
| Forwarding path | show ip cef 10.10.10.10 detail | Confirms hardware/software forwarding adjacency and next hop used by CEF. |
| ARP table | show arp | Maps IP to MAC. Incomplete ARP means Layer 2, VLAN, gateway, or host reachability issue. |
| MAC table | show mac address-table dynamic | Shows learned MAC, VLAN, and port. MAC on wrong port can indicate loop, move, or cabling issue. |
| Logs | show logging | Look for link flaps, protocol resets, authentication failures, STP events, and hardware warnings. |
| CPU | show processes cpu sorted | High CPU process names point to control-plane load, logging storms, routing churn, or bugs. |
| Memory | show memory statistics | Low free memory or processor memory growth can explain instability. |
| Platform/version | show version | Confirms uptime, reload reason, IOS version, model, serial, license, and config register. |
Workflow: link state, errors, VLAN, ARP/MAC, route, CEF, logs, CPU/memory. Browse the Cisco command reference for configuration examples.
OSPF Commands
Use these when routes are missing, neighbors are stuck, or OSPF behaves differently per interface.
| Need | Command | How to read the output |
|---|---|---|
| Neighbor state | show ip ospf neighbor | FULL is healthy. Stuck in INIT, 2WAY, EXSTART, or EXCHANGE points to hello, network type, MTU, or master/slave negotiation. |
| Neighbor detail | show ip ospf neighbor detail | Shows dead timer, retransmissions, adjacency uptime, and neighbor interface details. |
| Interface summary | show ip ospf interface brief | Confirms interface, area, cost, state, neighbor count, and process ID. |
| Interface detail | show ip ospf interface Gi0/1 | Read area, network type, timers, cost, DR/BDR, authentication, MTU, and passive state. |
| OSPF routes | show ip route ospf | O is intra-area, O IA inter-area, O E1/E2 external. Missing route means LSDB, area, filter, or redistribution issue. |
| LSDB summary | show ip ospf database | Confirms router, network, summary, and external LSAs exist in the local database. |
| Specific LSA | show ip ospf database router A.B.C.D | Use to inspect links advertised by one router; mismatched LSDB explains missing routes. |
| External routes | show ip ospf database external | Confirms type 5 LSAs from redistribution. If absent, check ASBR and filters. |
| Process settings | show ip protocols | Shows router ID, networks, passive interfaces, redistribution, timers, and route filters. |
| Running config | show running-config | section router ospf | Confirms network statements, area mapping, passive-interface, authentication, and redistribution. |
| OSPF events | show logging | include OSPF | Shows adjacency resets, duplicate router ID, authentication mismatch, or SPF churn. |
| IPv6 OSPFv3 | show ipv6 ospf neighbor | Same neighbor-state logic for OSPFv3; also verify IPv6 enabled on interface. |
Check first: area, network type, timers, MTU, passive interface, authentication. Practice the failure states in the OSPF troubleshooting lab.
BGP Commands
Use these to verify peer state, received prefixes, advertised prefixes, policy impact, and next-hop reachability.
| Need | Command | How to read the output |
|---|---|---|
| Peer summary | show ip bgp summary | State/PfxRcd should show a number. Idle, Active, or Connect means session is not established. |
| Neighbor detail | show ip bgp neighbors A.B.C.D | Read BGP state, uptime, last reset reason, capabilities, timers, message counters, and policy references. |
| BGP table | show ip bgp | * valid, > best, i iBGP. No best path usually means next hop unreachable or policy rejection. |
| Specific prefix | show ip bgp 203.0.113.0/24 | Shows AS path, next hop, local preference, MED, origin, communities, and best-path reason. |
| Advertised routes | show ip bgp neighbors A.B.C.D advertised-routes | Confirms what this router sends to the peer after outbound policy. |
| Received routes | show ip bgp neighbors A.B.C.D received-routes | Requires soft reconfiguration inbound. Shows routes before inbound policy. |
| Accepted routes | show ip bgp neighbors A.B.C.D routes | Shows routes accepted from the neighbor after inbound policy. |
| BGP routes in RIB | show ip route bgp | Confirms BGP best paths installed into the routing table. If missing, compare administrative distance and next hop. |
| Next-hop reachability | show ip route A.B.C.D | BGP path cannot install if the next hop is unreachable. |
| Policy objects | show route-map, show ip prefix-list | Check sequence numbers, permit/deny action, hit counts, and exact prefix length matching. |
| Config section | show running-config | section router bgp | Verify remote AS, update source, ebgp-multihop, address-family, route maps, and networks. |
| VPNv4/VRF | show bgp vpnv4 unicast all summary | For MPLS/VRF environments, confirms VPNv4 peers and route exchange. |
Common miss: next hop unreachable, route-map filtering, prefix-list mismatch, wrong AS, MD5 mismatch. Review the BGP troubleshooting lab.
VLAN and Trunk Commands
Use these when a host lands in the wrong VLAN, trunk traffic is missing, or MAC learning looks wrong.
| Need | Command | How to read the output |
|---|---|---|
| VLAN list | show vlan brief | Confirms VLAN exists and which access ports belong to it. |
| Port switchport mode | show interfaces Gi0/1 switchport | Read administrative/operational mode, access VLAN, trunk native VLAN, and allowed VLANs. |
| Trunk summary | show interfaces trunk | Check trunking status, native VLAN, allowed VLANs, and VLANs forwarding/not pruned. |
| Port status | show interfaces status | Shows connected state, VLAN, duplex, speed, and type. |
| Access port config | show running-config interface Gi0/1 | Confirms switchport mode, VLAN, port-security, voice VLAN, storm control, and descriptions. |
| MAC table all | show mac address-table dynamic | Shows learned MAC, VLAN, and interface. Missing MAC means host silent, wrong VLAN, or blocked path. |
| MAC by VLAN | show mac address-table dynamic vlan 10 | Limits output to one VLAN when troubleshooting one subnet. |
| MAC by interface | show mac address-table interface Gi0/1 | Confirms what endpoint or downstream switch is learned on a specific port. |
| ARP mapping | show ip arp vlan 10 | Connects IP-to-MAC for the SVI. Incomplete entries show unresolved hosts. |
| SVI state | show ip interface brief | include Vlan | SVI must be up/up for Layer 3 gateway service. Down/down usually means no active ports in VLAN. |
| Port channel | show etherchannel summary | P means bundled. I or suspended means LACP/config mismatch. |
| Port security | show port-security interface Gi0/1 | Read violation mode, max MACs, current MACs, and security violation count. |
Check first: access VLAN, allowed VLAN list, native VLAN, SVI up/up, spanning-tree blocking.
STP Troubleshooting
Use these when ports block unexpectedly, the root bridge changes, or users report intermittent loops/flapping.
| Need | Command | How to read the output |
|---|---|---|
| VLAN STP state | show spanning-tree vlan 10 | Read root bridge, local bridge ID, port role, port state, cost, and designated port. |
| Root summary | show spanning-tree root | Shows root bridge per VLAN. Unexpected root means priority/design issue. |
| Blocked ports | show spanning-tree blockedports | Lists ports intentionally blocking to prevent loops. |
| Topology changes | show spanning-tree vlan 10 detail | Read last topology change, from which port, and how often changes occur. |
| Inconsistent ports | show spanning-tree inconsistentports | Identifies ports blocked by Root Guard, Loop Guard, or type inconsistency. |
| PortFast/BPDU Guard | show spanning-tree interface Gi0/1 detail | Confirms edge/portfast state and BPDU activity on a port. |
| Errdisabled ports | show interfaces status err-disabled | Shows ports disabled by BPDU Guard, port-security, UDLD, link-flap, or storm-control. |
| Errdisable reason | show errdisable recovery | Shows causes enabled for auto recovery and remaining timers. |
| MAC flapping | show logging | include MACFLAP|SPANTREE|STP | MAC flaps often point to a loop, wrong port-channel, or unmanaged switch. |
| Root priority config | show running-config | include spanning-tree vlan | Confirms root primary/secondary or manual priority settings. |
| UDLD | show udld neighbors | Use on fiber links to confirm unidirectional link detection state. |
Watch: wrong root, BPDU Guard, Root Guard, native VLAN mismatch, MAC flapping.
Linux Networking Commands
Use these on servers, jump hosts, and appliances to prove local addressing, routes, sockets, DNS, and packets.
| Need | Command | How to read the output |
|---|---|---|
| Addresses | ip addr show | Check interface state, IP/mask, secondary addresses, and whether the interface is UP. |
| Routes | ip route show | Read default gateway, destination prefixes, interface, and selected source IP. |
| Route decision | ip route get 8.8.8.8 | Shows exact egress interface, gateway, and source address used for one destination. |
| Neighbor table | ip neigh show | REACHABLE is good; FAILED means ARP/ND failure; STALE may still work. |
| Listening ports | ss -tulpen | Shows protocol, local address, port, process, and whether service is bound to loopback or all interfaces. |
| Active sessions | ss -tan state established | Confirms current TCP sessions and remote endpoints. |
| Ping | ping -c 4 8.8.8.8 | Packet loss, latency, and duplicate packets point to reachability or path quality. |
| Path trace | traceroute 8.8.8.8 or tracepath 8.8.8.8 | Shows hop path and where responses stop. tracepath can reveal MTU. |
| DNS resolver | resolvectl status | Shows DNS servers, search domains, per-interface DNS, and DNSSEC state on systemd hosts. |
| DNS query | dig example.com A +short | Returns only answer records; empty output means no answer or resolver issue. |
| Firewall rules | sudo nft list ruleset or sudo iptables -S | Check default policy, drops, accepts, NAT, and rule order. |
| Interface counters | ip -s link show eth0 | Read RX/TX packets, drops, errors, overruns, and carrier issues. |
Order: IP, route, DNS, port, firewall, packet capture. Verify the path with the Ping & Latency Checker and Traceroute Tool.
tcpdump Cheat Sheet
Use tcpdump when logs disagree or you need proof that packets reached the interface.
| Need | Command | How to read the output |
|---|---|---|
| Host traffic | tcpdump -i eth0 -nn host 10.0.0.10 | Shows packets to or from the host. No packets means wrong interface, path, filter, or traffic not generated. |
| Source only | tcpdump -i eth0 -nn src host 10.0.0.10 | Proves whether the host sends traffic toward this interface. |
| Destination only | tcpdump -i eth0 -nn dst host 10.0.0.10 | Proves return or inbound traffic toward a host. |
| Port traffic | tcpdump -i eth0 -nn port 443 | Shows both TCP/UDP traffic for that port. Add tcp or udp to narrow it. |
| TCP handshake | tcpdump -i eth0 -nn 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0' | SYN without SYN-ACK means server/path/firewall issue. SYN/SYN-ACK/ACK means TCP established. |
| DNS only | tcpdump -i eth0 -nn udp port 53 | Look for query and response. Query without response means resolver/path/firewall issue. |
| ICMP | tcpdump -i eth0 -nn icmp | Shows ping, unreachable, TTL exceeded, and fragmentation-needed messages. |
| VLAN tag | tcpdump -i eth0 -nn -e vlan | -e displays Ethernet header, including VLAN tag when visible. |
| Packet detail | tcpdump -i eth0 -nn -vvv host 10.0.0.10 | More protocol detail: TTL, flags, options, lengths, and DNS details. |
| Save pcap | tcpdump -i eth0 -nn -s 0 -w capture.pcap | -s 0 captures full packets. Open the pcap later in Wireshark. |
| Read pcap | tcpdump -nn -r capture.pcap | Reads saved capture without name resolution. |
| Rotate files | tcpdump -i eth0 -nn -w cap-%H%M.pcap -G 300 -W 12 | Creates 5-minute capture files and keeps 12 files, useful for intermittent issues. |
Tip: use -nn to avoid DNS lookups changing the timing of your capture. For full website path checks, use the Website Not Opening Troubleshooting Guide.
Firewall Troubleshooting Checklist
Use this when traffic is denied, NAT is wrong, VPN traffic fails, or return traffic takes a different path.
| Check | Command or evidence | How to read the output |
|---|---|---|
| Policy match | Traffic log or policy test | Confirm source zone, destination zone, source IP, destination IP, service, app, action, and rule name. |
| Policy order | Rulebase lookup | First match wins. A broad deny or older allow rule can shadow the intended rule. |
| Source NAT | NAT rule hit/session translation | Verify original source becomes expected translated source and egress interface is correct. |
| Destination NAT | NAT rule hit/session translation | Verify public destination maps to the correct private IP and port. |
| Route lookup | Firewall route lookup for destination | Forward path must leave the expected interface/zone. Check return path separately. |
| Session table | Session details for 5-tuple | Look for allow/deny, timeout, bytes both directions, NAT, ingress/egress, and end reason. |
| Logs | Traffic, threat, system, VPN logs | Read deny reason, reset source, policy name, URL/app identification, and decryption status. |
| Packet capture | Capture ingress and egress interfaces | Ingress only means firewall/routing/NAT/policy issue. Egress only means return path issue. |
| VPN selectors | Proxy ID / traffic selector check | Local and remote subnets must mirror the peer. Wrong selectors drop interesting traffic. |
| VPN tunnel | IKE/IPsec SA status | Phase 1 up proves peer/auth; Phase 2 up proves selectors/proposals. Counters should increase. |
| MTU/MSS | DF ping, packet size test, TCP MSS profile | Small traffic works but large traffic fails when MTU/MSS/fragmentation is wrong. |
| Asymmetric path | Session bytes and captures both sides | One-way byte counters or missing return capture indicate a different return path. |
Best evidence: policy hit, session entry, packet capture on ingress and egress. For web outages, pair this checklist with the Website Not Opening Troubleshooting Guide.
DNS Troubleshooting
Use these when a name resolves differently by location, record type, resolver, or TTL.
| Need | Command | How to read the output |
|---|---|---|
| A record | dig example.com A +short | Returns IPv4 answers only. Empty output means no A answer or resolver problem. |
| AAAA record | dig example.com AAAA +short | Returns IPv6 answers. If clients prefer IPv6, bad AAAA records can break access. |
| Specific resolver | dig @8.8.8.8 example.com A | Compares public resolver output with internal resolver output. |
| Authoritative NS | dig example.com NS +short | Shows delegated name servers. Wrong NS means delegation issue. |
| Authoritative answer | dig @ns1.example.com example.com A | Queries authoritative server directly, bypassing recursive cache. |
| Trace delegation | dig example.com +trace | Walks root, TLD, and authoritative servers. Failure point shows delegation/DNSSEC issue. |
| MX records | dig example.com MX | Read priority and mail host. Lower preference number wins. |
| TXT records | dig example.com TXT | Check SPF, verification records, and split long TXT values. |
| CNAME chain | dig www.example.com CNAME | Shows alias target. Then resolve the target A/AAAA records. |
| SOA/serial | dig example.com SOA | Serial helps prove whether authoritative servers have the same zone version. |
| Reverse DNS | dig -x 8.8.8.8 | Checks PTR record. Useful for mail, logging, and ownership clues. |
| DNSSEC | dig example.com DNSKEY +dnssec | Use when validation fails; compare DS at parent and DNSKEY at child. |
Check: record type, authoritative server, TTL, split DNS, stale resolver cache. Compare results with the DNS Lookup and DNS Propagation Checker.
SSL Certificate Troubleshooting
Use these when HTTPS fails, certificate chains are incomplete, or the certificate does not match the hostname.
| Need | Command | How to read the output |
|---|---|---|
| Live TLS handshake | openssl s_client -connect example.com:443 -servername example.com | Check certificate chain, verify return code, protocol, cipher, and whether SNI returns the right certificate. |
| Show full chain | openssl s_client -showcerts -connect example.com:443 -servername example.com | Confirms server sends leaf plus required intermediate certificates. |
| Expiry | openssl x509 -in cert.pem -noout -dates | notBefore and notAfter show validity window. |
| Subject and issuer | openssl x509 -in cert.pem -noout -subject -issuer | Subject identifies leaf certificate; issuer should be a trusted CA/intermediate. |
| SAN names | openssl x509 -in cert.pem -noout -ext subjectAltName | Hostname must match SAN. Common Name alone is not enough for modern clients. |
| Fingerprint | openssl x509 -in cert.pem -noout -fingerprint -sha256 | Use to compare deployed cert with expected cert. |
| Certificate text | openssl x509 -in cert.pem -noout -text | Shows key usage, extended key usage, SAN, serial, signature algorithm, and public key size. |
| Verify chain | openssl verify -CAfile chain.pem cert.pem | OK means chain validates against provided CA bundle. Errors name the broken link. |
| Private key match | openssl x509 -noout -modulus -in cert.pem | openssl md5 | Compare with private key modulus hash. Hashes must match. |
| Key modulus | openssl rsa -noout -modulus -in private.key | openssl md5 | Use with previous command to prove cert and key pair belong together. |
| TLS versions | openssl s_client -tls1_2 -connect example.com:443 -servername example.com | Confirms whether TLS 1.2 works. Use -tls1_3 for TLS 1.3 checks. |
| HTTP headers over TLS | curl -Iv https://example.com | Shows TLS negotiation, HTTP status, redirects, HSTS, server header, and certificate subject in curl output. |
Common miss: missing intermediate, wrong SNI, expired cert, SAN mismatch, old TLS policy. Confirm the deployed chain with the SSL Certificate Checker.