Linux Basics — Tools

SECTION 6

Good job on completing the OverTheWire Bandit challenges! You have now learned the basics of Linux command line and file management.

This section introduces you to common command-line tools to check and explore networks.

Networking Tools

• ping — Test if a computer is reachable
• What it does: Sends a small message to another computer to see if it's online and how fast the response is.
• Why it's useful: You can check if your internet is working, or if a specific website or device is reachable.

Example: $ ping google.com What it might show: PING google.com (142.250.200.142) 56(84) bytes of data
64 bytes from 142.250.200.142: icmp_seq=1 ttl=117 time=20.4 ms
64 bytes from 142.250.200.142: icmp_seq=2 ttl=117 time=21.1 ms



• ip a — Show your computer's IP address
• What it does: Displays the IP addresses assigned to your computer's network interfaces.
• Why it's useful: You can find out your computer's local and public IP addresses, which is important for networking.

Example: $ ip a What it might show: 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> ...
inet 192.168.1.42/24 brd 192.168.1.255 scope global dynamic eth0



• netstat or ss — See open ports and connections
• What it does: Lists the network connections your computer is making and ports it's listening on.
• Why it's useful: Useful for spotting unexpected programs connecting to the internet or checking if your server is running.

Example: $ netstat -tulnp What it might show:

Proto  Recv-Q Send-Q Local Address    Foreign Address  State   PID/Program name
tcp        0      0  0.0.0.0:22      0.0.0.0:*        LISTEN  743/sshd
udp        0      0  0.0.0.0:68      0.0.0.0:*        LISTEN  644/dhclient
                        



• nmap — Scan other devices on the network
• What it does: Checks what ports are open on a remote device and tries to guess what services are running.
• Why it's useful: Helps you understand what other devices are doing and if they might be vulnerable.

🚫 Note: Scanning networks, devices and services without permission is illegal! Only scan your own devices or those you have explicit permission to test.




Example: $ nmap -sV 192.168.1.10 What it might show:

Nmap scan report for 192.168.1.1
Host is up (0.0010s latency).
Not shown: 999 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh      OpenSSH 8.2
80/tcp   open  http     Apache httpd 2.4.41
                        



• arp-scan — Discover devices on your local network
• What it does: Finds every device connected to the same Wi-Fi or LAN.
• Why it's useful: Great way to see who's sharing your network, even hidden or unnamed devices.

Example: $ sudo arp-scan --interface=eth0 --localnet What it might show:

192.168.1.1  00:11:22:33:44:55  TP-Link Technologies
192.168.1.42 00:0c:29:ab:cd:ef  Raspberry Pi Foundation
                    

Bonus tools

• traceroute — Follow the path to a website
• What it does: Shows every server your data passes through on its way to a website.
• Why it's useful: Helps spot where network delays or issues might be happening.

Example: $ traceroute example.com



• dig or nslookup — Check domain name info (DNS)
• What it does: Asks the internet's “phone book” what IP address a domain (like bing.com) uses.
• Why it's useful: Understanding DNS is key to how the web works.

Example: $ dig example.com



• tcpdump — Capture all network traffic (advanced)
• What it does: Records packets (tiny data chunks) going in and out of your computer.
• Why it's useful: Very powerful for analyzing or debugging network behavior.

Example: $ sudo tcpdump -i eth0

Exercise

Now that you know the basics of networking tools, it's time to practice!

• Get back to overthewire and complete exercises 14-20! (I know you need to complete 9-13 before you get the password to get here, but greatness has never been without a cost!)

⚠️ Reminder: Always get permission before scanning or sniffing any network. Stick to school labs, virtual machines or your own LAN.