Networking and troubleshooting

nslookup

nslookup [-type=<type>] <name> [server]

Queries a DNS server (Windows and Linux).

nslookup -type=MX contoso.com 1.1.1.1
nslookup -type=TXT _dmarc.contoso.com
nslookup 8.8.8.8

dig

dig [@server] <name> [type] [+short] [+trace]

Detailed DNS query (Linux, macOS, Windows via BIND).

dig contoso.com MX +short
dig @1.1.1.1 contoso.com TXT
dig +trace contoso.com
dig -x 8.8.8.8 +short

Resolve-DnsName

Resolve-DnsName <name> [-Type <type>] [-Server <ip>] [-DnsOnly]

DNS resolution in PowerShell, output as objects.

Resolve-DnsName contoso.com -Type MX
Resolve-DnsName contoso.com -Server 8.8.8.8 -DnsOnly

ipconfig /flushdns · resolvectl flush-caches

ipconfig /flushdns | resolvectl flush-caches

Clears the local DNS cache after a record change.

ipconfig /flushdns
ipconfig /displaydns
sudo resolvectl flush-caches
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

ping

ping [-n|-c <count>] <host>

Tests whether a host is reachable over ICMP.

ping -n 4 8.8.8.8      # Windows
ping -c 4 8.8.8.8      # Linux
ping -t 192.168.1.1    # Windows : continu, Ctrl+C pour arrêter
ping -f -l 1472 8.8.8.8  # Windows : test de MTU (sans fragmentation)

tracert · traceroute · mtr

tracert <host> | traceroute <host> | mtr <host>

Shows the routers crossed on the way to a destination.

tracert -d contoso.com
traceroute -n contoso.com
mtr -rwc 50 contoso.com
pathping contoso.com

ip a · ip r · ip link

ip addr | ip route | ip link

Addresses, routes and interfaces on Linux (replaces ifconfig and route).

ip -br a
ip route
ip route get 8.8.8.8
sudo ip link set eth0 up

route print · Get-NetRoute

route print | Get-NetRoute

Windows routing table.

route print -4
Get-NetRoute -AddressFamily IPv4 | Sort RouteMetric | Select DestinationPrefix,NextHop,InterfaceAlias,RouteMetric

arp

arp -a

IP address to MAC address mapping table of the local segment.

arp -a
ip neigh

ss

ss -tulpn

Listening sockets and connections (replaces netstat on Linux).

sudo ss -tulpn
ss -tn state established
ss -tn dst :443

netstat -ano

netstat -ano | findstr :<port>

Windows TCP/UDP connections with the process ID (PID).

netstat -ano | findstr LISTENING
netstat -ano | findstr :443
tasklist /fi "pid eq 1234"

Test-NetConnection · nc

Test-NetConnection <host> -Port <port> | nc -zv <host> <port>

Checks that a TCP port is reachable.

Test-NetConnection smtp.office365.com -Port 587
nc -zv smtp.office365.com 587
nc -zvu 10.0.0.5 514

nmap

nmap [-sS|-sT|-sU] [-p <ports>] [-sV] <target>

Scans a network for hosts and open ports.

nmap -sn 192.168.1.0/24
nmap -p 22,80,443 -sV 192.168.1.10
nmap -sU -p 53,123,161 192.168.1.1

tcpdump

tcpdump -i <interface> [filter] [-w file.pcap]

Captures traffic on the command line.

sudo tcpdump -i eth0 -nn host 10.0.0.5 and port 443
sudo tcpdump -i any -nn udp port 53 -c 50
sudo tcpdump -i eth0 -w capture.pcap

pktmon

pktmon start --capture ; pktmon stop ; pktmon etl2pcap

Network capture built into Windows 10/11, no third-party software.

pktmon filter add -p 443
pktmon start --capture --comp nics
pktmon stop
pktmon etl2pcap PktMon.etl --out capture.pcapng

curl

curl [-I] [-v] [-L] [--resolve h:p:ip] <url>

Tests a URL: headers, redirects, response time, certificate.

curl -I https://contoso.com
curl -vL https://contoso.com -o /dev/null
curl --resolve contoso.com:443:203.0.113.10 https://contoso.com -I
curl -w '%{http_code} %{time_total}s\n' -o /dev/null -s https://contoso.com

openssl s_client

openssl s_client -connect <host>:<port> -servername <name>

Shows a server's certificate and TLS chain.

openssl s_client -connect contoso.com:443 -servername contoso.com </dev/null | openssl x509 -noout -dates -subject -issuer
openssl s_client -starttls smtp -connect smtp.contoso.com:587

Ports 20/21 · 22 · 23 · 25 (FTP, SSH, Telnet, SMTP)

FTP 21 (data 20) · SSH/SFTP 22 · Telnet 23 · SMTP 25

SFTP uses port 22 (SSH); FTPS and FTP are separate protocols. Port 25 is used for relaying between mail servers and is often blocked by ISPs.

Ports 53 · 67/68 · 123 (DNS, DHCP, NTP)

DNS 53 TCP/UDP · DHCP 67 (server) / 68 (client) UDP · NTP 123 UDP

DNS switches to TCP for large responses and zone transfers. DHCP and NTP use UDP.

Ports 80 · 443 · 8080 · 8443 (HTTP, HTTPS)

HTTP 80 · HTTPS 443 (HTTP/3: UDP 443) · alternates 8080, 8443

HTTP/3 (QUIC) uses UDP 443: a firewall that does not allow it forces a fallback to HTTPS/TCP.

Ports 110 · 143 · 465 · 587 · 993 · 995 (email)

POP3 110/995 · IMAP 143/993 · SMTPS 465 · SMTP submission 587 (STARTTLS)

Ports 995, 993 and 465 use implicit TLS; 587 starts in clear text, then upgrades with STARTTLS.

Ports 88 · 135 · 389 · 445 · 636 · 3268 (Active Directory)

Kerberos 88 · RPC 135 · LDAP 389 · SMB 445 · LDAPS 636 · global catalog 3268/3269

Main ports between workstations, servers and domain controllers; RPC also uses a dynamic range (49152-65535).

Ports 3389 · 5985/5986 · 5900 (remote access)

RDP 3389 TCP/UDP · WinRM 5985 (HTTP) / 5986 (HTTPS) · VNC 5900

RDP and WinRM are frequent brute-force targets when exposed.

Ports 161/162 · 514 · 1812/1813 (monitoring)

SNMP 161 / traps 162 UDP · Syslog 514 UDP (6514 TLS) · RADIUS 1812/1813 UDP

Common ports for monitoring and network authentication.

Ports 1433 · 3306 · 5432 · 6379 (databases)

SQL Server 1433 · MySQL/MariaDB 3306 · PostgreSQL 5432 · Redis 6379

Common database ports: never expose them directly to the internet.