LabProveHub

Appearance

Essential Networking Tools for Network Technicians ​

A practical reference guide covering the most widely used tools in day-to-day network operations — from packet analysis to infrastructure monitoring.

Table of Contents ​

  1. Packet Analysis
  2. Network Scanning & Discovery
  3. Connectivity & Path Testing
  4. DNS Utilities
  5. Bandwidth & Performance Testing
  6. Remote Access & Management
  7. Traffic Capture (CLI)
  8. Network Configuration & Monitoring
  9. Vulnerability & Security Assessment
  10. Protocol-Specific Tools

Packet Analysis ​

Wireshark ​

Platform: Windows, macOS, Linux
Type: GUI packet analyzer

The most widely used network protocol analyzer in the industry. Wireshark captures live traffic from any network interface and decodes hundreds of protocols in real time.

Common use cases:

  • Diagnosing slow application performance
  • Inspecting TLS handshake failures
  • Verifying VLAN tags and 802.1Q headers
  • Capturing DHCP/DNS exchange sequences

Key features:

  • Display filters (e.g., ip.addr == 10.0.0.1 && tcp.port == 443)
  • Follow TCP/UDP stream for full session reconstruction
  • Export as PCAP for offline analysis
  • Statistics > I/O Graphs for visual throughput analysis

Technician tip: Use capture filters at the interface level to reduce file size on busy networks. Example: host 192.168.1.100 and port 80.

tshark ​

Platform: Windows, macOS, Linux
Type: CLI packet analyzer

The command-line counterpart to Wireshark. Essential for headless servers, scripting, and automated analysis pipelines.

bash
# Capture 100 packets on interface eth0
tshark -i eth0 -c 100

# Filter by IP and write to file
tshark -i eth0 -f "host 10.0.0.5" -w capture.pcap

# Read PCAP and display HTTP requests
tshark -r capture.pcap -Y "http.request"

Network Scanning & Discovery ​

Nmap (Network Mapper) ​

Platform: Windows, macOS, Linux
Type: Port scanner / host discovery

The de facto standard for network reconnaissance. Nmap identifies live hosts, open ports, running services, OS versions, and can execute scripts against targets.

Common commands:

bash
# Ping sweep — discover live hosts
nmap -sn 192.168.1.0/24

# TCP SYN scan with service version detection
nmap -sS -sV 192.168.1.10

# OS detection
nmap -O 192.168.1.10

# Aggressive scan (OS, version, scripts, traceroute)
nmap -A 192.168.1.10

# Scan specific ports
nmap -p 22,80,443,3389 192.168.1.0/24

# Output to all formats
nmap -A 192.168.1.0/24 -oA scan_results

Nmap Scripting Engine (NSE): Extend functionality with scripts for vulnerability detection, brute force, and service enumeration.

bash
# Check for SMB vulnerabilities
nmap --script smb-vuln-ms17-010 192.168.1.10

# HTTP header enumeration
nmap --script http-headers 192.168.1.10 -p 80

Note: Always obtain written authorization before scanning networks you do not own or administer.

Angry IP Scanner ​

Platform: Windows, macOS, Linux
Type: GUI host/port scanner

A lightweight, fast alternative to Nmap for quick host discovery. Useful for non-technical users or environments where Nmap is not installed. Less flexible than Nmap but faster for simple subnet sweeps.

Advanced IP Scanner ​

Platform: Windows
Type: GUI network scanner

Popular in Windows-centric environments. Integrates with Radmin for remote control and provides a clean interface for discovering devices, MAC addresses, and shared resources.

Connectivity & Path Testing ​

ping ​

Platform: All operating systems (built-in)
Type: ICMP reachability test

The most fundamental connectivity tool. Sends ICMP Echo Requests to a target and measures round-trip time (RTT).

bash
# Basic ping
ping 8.8.8.8

# Ping with count (Linux/macOS)
ping -c 4 192.168.1.1

# Ping with count (Windows)
ping -n 4 192.168.1.1

# Continuous ping (Windows)
ping -t 192.168.1.1

Limitation: ICMP is frequently blocked by firewalls. A failed ping does not always mean a host is down.

traceroute / tracert ​

Platform: Linux/macOS (traceroute), Windows (tracert)
Type: Path tracing

Maps the Layer 3 path between source and destination by incrementing the TTL of each probe packet, forcing each hop to return an ICMP Time Exceeded message.

bash
# Linux/macOS
traceroute 8.8.8.8

# Windows
tracert 8.8.8.8

# Use TCP instead of UDP (useful when firewalls block UDP)
traceroute -T -p 80 8.8.8.8

mtr (My Traceroute) ​

Platform: Linux, macOS (Windows port available)
Type: Combined ping + traceroute

Continuously probes each hop along a path and displays running statistics — packet loss, latency, jitter — per hop in real time. Far more useful than a single traceroute for diagnosing intermittent path issues.

bash
# Interactive mode
mtr 8.8.8.8

# Report mode (non-interactive, 100 cycles)
mtr --report --report-cycles 100 8.8.8.8

pathping ​

Platform: Windows (built-in)
Type: Combined path tracer with statistics

Windows-native equivalent to mtr. Traces the path, then probes each hop over a period of time to calculate per-hop packet loss statistics.

bash
pathping 8.8.8.8

DNS Utilities ​

nslookup ​

Platform: Windows, Linux, macOS (built-in)
Type: DNS query tool

The most common quick DNS lookup tool across platforms. Supports querying specific record types and targeting specific DNS servers.

bash
# Basic forward lookup
nslookup google.com

# Query specific DNS server
nslookup google.com 8.8.8.8

# Reverse lookup (PTR record)
nslookup 8.8.8.8

# Interactive mode — query MX records
nslookup
> set type=MX
> google.com

dig (Domain Information Groper) ​

Platform: Linux, macOS; available on Windows via BIND tools
Type: Advanced DNS query tool

Preferred over nslookup for scripting and detailed DNS troubleshooting. Output is more structured and consistent.

bash
# A record lookup
dig google.com

# Query specific record type
dig google.com MX
dig google.com TXT
dig google.com NS

# Short output only
dig google.com +short

# Query specific server
dig @8.8.8.8 google.com

# Reverse DNS
dig -x 8.8.8.8

# Check DNSSEC
dig google.com +dnssec

host ​

Platform: Linux, macOS
Type: Simple DNS lookup

Simpler than dig, good for quick lookups in scripts.

bash
host google.com
host -t MX google.com

Bandwidth & Performance Testing ​

iperf3 ​

Platform: Windows, Linux, macOS
Type: Network throughput tester

The standard tool for measuring raw TCP/UDP throughput between two endpoints. Requires running in server mode on one side and client mode on the other.

bash
# Start server (on target host)
iperf3 -s

# TCP throughput test (on client)
iperf3 -c 192.168.1.50

# UDP test at 100 Mbps for 30 seconds
iperf3 -c 192.168.1.50 -u -b 100M -t 30

# Reverse mode — server sends, client receives
iperf3 -c 192.168.1.50 -R

# Multi-stream test (simulates real-world traffic better)
iperf3 -c 192.168.1.50 -P 4

speedtest-cli ​

Platform: Windows, Linux, macOS
Type: Internet speed test (CLI)

Command-line interface to Speedtest.net. Useful for scripting periodic WAN throughput checks.

bash
speedtest-cli
speedtest-cli --simple

Remote Access & Management ​

SSH (OpenSSH) ​

Platform: All platforms (built-in on Linux/macOS; built-in on Windows 10+)
Type: Encrypted remote shell

The primary tool for securely managing remote Linux/Unix systems, network devices (routers, switches), and servers. Replaces Telnet for all modern environments.

bash
# Basic connection
ssh user@192.168.1.10

# Connect on non-standard port
ssh -p 2222 user@192.168.1.10

# Key-based authentication
ssh -i ~/.ssh/id_rsa user@192.168.1.10

# Port forwarding (local tunnel)
ssh -L 8080:internal-server:80 user@jump-host

# SOCKS proxy through SSH
ssh -D 1080 user@192.168.1.10

PuTTY ​

Platform: Windows
Type: GUI SSH/Telnet/Serial client

The most widely used SSH client on Windows in enterprise environments. Supports SSH, Telnet, Serial, and raw TCP connections. PuTTY also includes plink (CLI SSH) and pscp (SCP file transfer).

SCP / SFTP ​

Platform: All platforms
Type: Secure file transfer over SSH

Used to transfer files between hosts securely.

bash
# Copy local file to remote
scp file.txt user@192.168.1.10:/home/user/

# Copy remote file to local
scp user@192.168.1.10:/var/log/syslog ./

# Recursive directory copy
scp -r /local/dir user@192.168.1.10:/remote/dir

Traffic Capture (CLI) ​

tcpdump ​

Platform: Linux, macOS
Type: CLI packet capture

The essential CLI packet capture tool for Linux systems and network devices. Writes PCAP files that can be opened in Wireshark.

bash
# Capture on interface eth0
tcpdump -i eth0

# Capture with host filter, write to file
tcpdump -i eth0 host 10.0.0.5 -w capture.pcap

# Capture HTTPS traffic (port 443)
tcpdump -i eth0 port 443

# Verbose output, don't resolve hostnames
tcpdump -i eth0 -vnn

# Capture DNS queries
tcpdump -i eth0 port 53

Network Configuration & Monitoring ​

ip / ifconfig ​

Platform: Linux (ip), older Linux/macOS (ifconfig)
Type: Interface configuration and routing

Used to view and configure network interfaces, routing tables, ARP cache, and more.

bash
# Show all interfaces
ip addr show

# Show routing table
ip route show

# Show ARP table
ip neigh show

# Add a static route
ip route add 10.10.0.0/24 via 192.168.1.1

netstat / ss ​

Platform: All platforms
Type: Network connection and socket statistics

Display active connections, listening ports, routing tables, and interface statistics.

bash
# Show all listening ports (ss — faster, preferred on modern Linux)
ss -tuln

# Show all active TCP connections
ss -tnp

# Windows equivalent
netstat -an
netstat -b    # Show owning process (requires admin)

arp ​

Platform: All platforms (built-in)
Type: ARP cache inspection

View and manipulate the ARP cache — the mapping of IP addresses to MAC addresses on the local segment. Critical for diagnosing duplicate IP issues and verifying Layer 2 connectivity.

bash
# View ARP table (Linux)
arp -n

# View ARP table (Windows)
arp -a

# Add static ARP entry (Linux)
arp -s 192.168.1.50 AA:BB:CC:DD:EE:FF

SNMP Tools (snmpwalk, snmpget) ​

Platform: Linux, Windows (via net-snmp)
Type: SNMP polling

Query network devices (switches, routers, UPS units) via SNMP to pull interface counters, CPU utilization, error rates, and other OID values.

bash
# Walk all OIDs on a device (SNMPv2c)
snmpwalk -v2c -c public 192.168.1.1

# Get a specific OID (interface description)
snmpget -v2c -c public 192.168.1.1 ifDescr.1

# Get interface traffic counters
snmpwalk -v2c -c public 192.168.1.1 ifInOctets

Vulnerability & Security Assessment ​

Nessus / OpenVAS ​

Platform: Windows, Linux, macOS
Type: Vulnerability scanner

Used in security assessments to identify known vulnerabilities, misconfigurations, and missing patches across hosts and network devices.

  • Nessus (Tenable): Commercial product with a free "Essentials" tier for up to 16 IPs.
  • OpenVAS (Greenbone): Open-source alternative, part of the Greenbone Vulnerability Manager (GVM) stack.

Metasploit Framework ​

Platform: Linux, Windows, macOS
Type: Penetration testing framework

Used by security professionals to validate vulnerabilities discovered during assessments. Contains exploits, payloads, and post-exploitation modules.

Important: Metasploit must only be used in authorized penetration testing engagements or isolated lab environments. Unauthorized use is illegal.

Protocol-Specific Tools ​

curl ​

Platform: Windows, Linux, macOS (built-in)
Type: HTTP/HTTPS/FTP client (CLI)

Tests HTTP/S connectivity, APIs, authentication headers, TLS certificates, and more from the command line.

bash
# Basic HTTP GET
curl http://example.com

# Show response headers only
curl -I https://example.com

# POST with JSON body
curl -X POST https://api.example.com/data \
  -H "Content-Type: application/json" \
  -d '{"key":"value"}'

# Test TLS certificate details
curl -v https://example.com 2>&1 | grep -A5 "SSL"

# Follow redirects
curl -L http://example.com

Telnet ​

Platform: Windows, Linux, macOS
Type: Legacy remote shell / port connectivity tester

Telnet is insecure for remote access (cleartext), but remains useful as a quick port connectivity test — particularly for verifying that TCP ports are open and services are responding.

bash
# Test if TCP port 25 (SMTP) is open
telnet mail.example.com 25

# Test HTTPS port
telnet 192.168.1.10 443

OpenSSL ​

Platform: Windows, Linux, macOS
Type: TLS/SSL inspection and testing

Inspect certificates, test TLS handshakes, and diagnose SSL/TLS issues.

bash
# Inspect a server's TLS certificate
openssl s_client -connect example.com:443

# Check certificate expiry
echo | openssl s_client -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates

# Test specific TLS version
openssl s_client -connect example.com:443 -tls1_2

Quick Reference Summary ​

ToolCategoryPlatformGUI/CLI
WiresharkPacket AnalysisAllGUI
tsharkPacket AnalysisAllCLI
NmapScanningAllCLI
pingConnectivityAll (built-in)CLI
traceroute/tracertPath AnalysisAll (built-in)CLI
mtrPath AnalysisLinux/macOSCLI
nslookupDNSAll (built-in)CLI
digDNSLinux/macOSCLI
iperf3BandwidthAllCLI
SSHRemote AccessAllCLI
PuTTYRemote AccessWindowsGUI
tcpdumpCaptureLinux/macOSCLI
ss / netstatConnectionsAllCLI
arpLayer 2All (built-in)CLI
snmpwalkSNMPLinux/WindowsCLI
curlHTTP TestingAllCLI
OpenSSLTLS TestingAllCLI
Nessus/OpenVASVulnerabilityAllGUI
  1. Start with the built-ins — master ping, traceroute, nslookup, arp, and netstat/ss first. These are available everywhere with no installation required.
  2. Add Wireshark — understanding protocol flows at the packet level transforms how you troubleshoot.
  3. Learn Nmap — essential for auditing what is exposed on your network.
  4. Add tcpdump — for headless environments and scripted captures.
  5. iperf3 + mtr — for performance and path quality validation.
  6. curl + OpenSSL — critical as more services move to HTTPS and API-based architectures.

This guide covers tools in active professional use as of 2025. Always verify tool versions and feature availability for your specific OS and distribution.

LabProveHub Knowledge Base

Copyright © 2025-present LabProveHub