Network and DNS troubleshooting commands: ip, ss, dig, resolvectl

When something “does not work over the network”, check from the bottom up: is the interface up and addressed, is there a route, does the name resolve, is anything listening, and is a firewall in the way. These commands are available on current Debian, Ubuntu and RHEL family systems; dig may need a package (see the end).

Interfaces and addresses: ip

ip -br link                  # interfaces and UP/DOWN state, one per line
ip -br address               # addresses, one line per interface
ip address show enp1s0       # full details for one interface
ip -4 address                # IPv4 only (-6 for IPv6)
ip neigh                     # ARP/neighbor table: who is on the local network

ip replaces the old ifconfig, route and arp commands, which are not installed by default on many current systems.

Routes

ip route                     # routing table; look for the "default via" line
ip route get 192.0.2.80      # which interface and gateway the kernel would use

ip route get sends nothing; it only asks the kernel which route it would pick. It is the fastest way to explain “why does traffic leave through the wrong interface”.

Reachability

ping -c 4 192.0.2.1          # gateway reachable?
ping -c 4 example.com        # name resolution + reachability
tracepath example.com        # the path, hop by hop (no root needed)
curl -sv https://example.com -o /dev/null   # full HTTP/TLS test

Many hosts and firewalls block ICMP, so a failing ping does not prove a host is down. Test the actual port with curl or nc -zv host 443 if nc is installed.

Listening ports and connections: ss

sudo ss -tlnp                # TCP sockets in LISTEN state, numeric, with process
sudo ss -ulnp                # the same for UDP
ss -tn state established     # current TCP connections
sudo ss -tlnp | grep ':443'

• -t TCP, -u UDP, -l listening only, -n numeric (no name lookups), -p show the process (needs root for other users’ processes).
• A service listening on 127.0.0.1:8080 is reachable only from the server itself. To be reachable from outside it must listen on 0.0.0.0, [::] or the server’s address.

ss replaces netstat.

DNS: dig

dig example.com                     # A record, full answer
dig +short example.com              # just the addresses
dig example.com MX                  # mail servers (also AAAA, TXT, NS, CNAME...)
dig @192.0.2.53 example.com         # ask one specific DNS server
dig -x 192.0.2.10                   # reverse lookup (PTR)
dig +noall +answer example.com      # only the answer section
dig +trace example.com              # follow the delegation from the root servers

Asking a specific server with @ separates “the record is wrong” from “my resolver is wrong”: if the authoritative server answers correctly and your normal resolver does not, the problem is caching or resolver configuration.

DNS: what the system resolver does

dig talks to DNS servers directly. Programs on the server use the system resolver, which also reads /etc/hosts and may go through systemd-resolved. To test what applications actually see:

getent hosts example.com       # resolves exactly like most programs do
cat /etc/resolv.conf

On systems running systemd-resolved (Ubuntu by default), /etc/resolv.conf typically points to a local stub at 127.0.0.53, and the real upstream servers are shown by resolvectl:

resolvectl status               # DNS servers and search domains per interface
resolvectl query example.com    # resolve through systemd-resolved
sudo resolvectl flush-caches    # clear its cache after a DNS change
resolvectl statistics           # cache hits, DNSSEC state

Firewalls

sudo firewall-cmd --list-all   # RHEL, Rocky, AlmaLinux (firewalld)
sudo ufw status verbose        # Ubuntu (ufw)
sudo nft list ruleset          # the underlying nftables rules

Installing missing tools

# Debian/Ubuntu
sudo apt install dnsutils     # dig (newer releases also name it bind9-dnsutils)
# RHEL, Rocky, AlmaLinux
sudo dnf install bind-utils

Official documentation

• ip(8)
• resolvectl(1)
• BIND 9 manual pages: dig