Chapter 38 — The tools: `ss`, `curl`, `dig`, `tcpdump`, and a firewall's basics

In one sentence

A small set of command-line tools — ss for local connections, curl for making requests, dig for DNS, tcpdump for watching raw traffic, and basic firewall commands — cover the overwhelming majority of real network troubleshooting you'll ever do.

Why this matters

These are the exact tools referenced constantly across incident postmortems and on-call runbooks industry-wide — fluency here is a direct, practical career skill, not academic knowledge.

How it actually works

   ss -tulpn              # every LISTENING socket on this machine:
                         # protocol (t=tcp, u=udp), listening state,
                         # PID/process name. THE modern replacement for
                         # the older `netstat` (see below).
   ss -tn state established    # currently ESTABLISHED TCP connections

   curl -v https://example.com    # make an HTTP(S) request, -v shows
                                 # the full request/response, headers
                                 # and all
   curl -o file.txt <url>          # save output to a file instead of
                                 # printing it
   curl -I <url>                    # HEAD request only -- just headers,
                                 # fast way to check if something's
                                 # reachable and what it returns

   dig example.com                   # full DNS lookup, with all the
                                 # detail
   dig +short example.com             # just the answer -- the IP(s)
   dig example.com MX                  # a SPECIFIC record type (mail
                                 # servers, in this case)

   tcpdump -i any port 443              # watch raw packets live,
                                 # filtered to a specific port
                                 # (needs root/sudo)

   # basic firewall inspection (varies by distro/tooling -- ufw is
   # common on Ubuntu, firewalld on RHEL/Fedora, both are friendly
   # frontends on top of the kernel's netfilter/iptables/nftables)
   sudo ufw status               # Ubuntu-style
   sudo firewall-cmd --list-all   # RHEL/Fedora-style

Real-world example

   `ss` replacing `netstat` is a genuinely well-documented, real tooling
   transition worth knowing the story of, because it explains why some
   tutorials you'll find online teach a command that's no longer the
   recommended default: `netstat` (along with `ifconfig`, `route`, and
   others) came from the older `net-tools` package, which -- as
   documented in its own project history and repeatedly discussed across
   Linux distribution mailing lists and release notes -- went through a
   LONG period with little to no active maintenance. `iproute2` (which
   provides `ss`, `ip`, and related modern commands) became the actively
   maintained, kernel-feature-current replacement, and most major
   distributions eventually stopped installing `net-tools` BY DEFAULT,
   years apart from each other, causing exactly the confusion you'd
   expect: countless still-circulating tutorials and Stack Overflow
   answers reference `netstat`/`ifconfig` commands that may not even be
   INSTALLED on a fresh, modern system.
   THE PRACTICAL LESSON: `ss` and `ip` are the current, actively-
   maintained standard (`ss` for socket/connection info, `ip` for
   interfaces/routes/addresses -- Chapter 37's commands) -- worth learning
   as your defaults, while still recognising `netstat`/`ifconfig` syntax
   when you encounter them in older material, exactly the way you'd
   recognise an older dialect of a language you're fluent in.

Try it yourself

# See what's actually listening on your machine, and by what
sudo ss -tulpn | head -15

# Make some real requests and inspect them
curl -I https://example.com
curl -v https://example.com 2>&1 | head -20

# Real DNS lookups
dig +short example.com
dig example.com MX +short

# Watch real traffic (needs sudo; Ctrl-C to stop; generates traffic
# with curl in a second terminal, or just watch DNS lookups happen)
sudo timeout 5 tcpdump -i any port 53 -n 2>/dev/null &
dig example.com > /dev/null
wait

# Check your firewall's current state (read-only, safe)
sudo ufw status 2>/dev/null || sudo firewall-cmd --list-all 2>/dev/null || \
  sudo iptables -L -n 2>/dev/null | head -15

Common mistakes

Following a tutorial that uses netstat/ifconfig and being confused they're missing. Recognise the older syntax, but reach for ss/ip as your actual default on modern systems.
Using curl without -v/-I when troubleshooting, and only seeing the body. The headers and status code are very often where the actual problem/answer is.
Assuming a firewall's default-deny stance is "broken" rather than intentional. A properly hardened box denies everything not explicitly allowed — a connection failing might be the firewall doing exactly its job, not a bug.

Check yourself

What replaced netstat, and why?
What does dig +short give you that plain dig doesn't, and when would you want the fuller output instead?
Given "I can't reach this web service," name the check-in-order sequence from Chapter 37 combined with this chapter's tools.

Chapter 38 — The tools: ss, curl, dig, tcpdump, and a firewall's basics