~/ linuxnetwork.net

Mastering Interface & Connection Information with net-tools: A Comprehensive Guide

Net-tools is a legacy suite of command-line utilities for managing network interfaces, connections, and routing tables on Unix-like operating systems. Developed in the early 1990s, it became the de facto standard for network administration for decades. The last official release was in 2001, and net-tools is now considered deprecated by most major Linux distributions, including Debian, Arch Linux, and Red Hat Enterprise Linux. Modern distributions have adopted iproute2 (a more powerful, kernel-integrated alternative) as the default network toolset, and many no longer install net-tools by default.

Despite its deprecated status, net-tools remains relevant for:

  • Maintaining legacy systems and scripts that rely on its syntax.
  • Troubleshooting network issues on older servers or embedded devices where iproute2 is unavailable.
  • Gaining a foundational understanding of network concepts before moving to modern tools.

This guide covers the core net-tools commands for inspecting interface status and connection information, with detailed examples, best practices, and migration guidance for transitioning to iproute2.

Table of Contents#

  1. Introduction to net-tools and its Relevance
  2. Key Commands for Interface & Connection Information 2.1 ifconfig: Network Interface Configuration & Status 2.2 netstat: Network Connection & Statistics 2.3 arp: Address Resolution Protocol Table Management 2.4 route: Routing Table Configuration & Inspection
  3. Migrating to iproute2: Modern Alternatives
  4. Troubleshooting Common Scenarios with net-tools
  5. Frequently Asked Questions (FAQ)
  6. Conclusion
  7. References

2. Key Commands for Interface & Connection Information#

2.1 ifconfig: Network Interface Configuration & Status#

2.1.1 Basic Syntax & Core Functionality#

ifconfig (interface configurator) is used to:

  • Display the status of active/inactive network interfaces.
  • Assign IP addresses, netmasks, and MTU values to interfaces.
  • Bring interfaces up or down.

Basic Syntax:

ifconfig [interface] [options] [IP netmask]

2.1.2 Common Usage Examples#

  1. Show all active interfaces:

    ifconfig

    Output includes IP address, MAC address, broadcast address, and interface state (e.g., UP, RUNNING).

  2. Show all interfaces (including inactive):

    ifconfig -a

    Useful for diagnosing disabled or unconfigured interfaces.

  3. Inspect a specific interface:

    ifconfig eth0

  4. Bring an interface up/down:

    sudo ifconfig eth0 up
sudo ifconfig eth0 down

  5. Assign a static IP address:

    sudo ifconfig eth0 192.168.1.10 netmask 255.255.255.0 broadcast 192.168.1.255

2.1.3 Best Practices#

  • Always use sudo when modifying interface settings (requires root privileges).
  • Use -a to avoid missing inactive interfaces that may be causing connectivity issues.
  • Verify changes with ifconfig <interface> immediately after making them.
  • Avoid using ifconfig in new automation scripts; prefer ip addr or ip link from iproute2 for long-term compatibility.

2.2 netstat: Network Connection & Statistics#

2.2.1 Basic Syntax & Core Functionality#

netstat (network statistics) provides real-time insights into:

  • Established, listening, and pending network connections.
  • Routing tables, interface statistics, and protocol-specific metrics.

Basic Syntax:

netstat [options]

2.2.2 Common Usage Examples#

  1. List all listening TCP/UDP ports with process details:

    sudo netstat -tulpn

    Flags breakdown:

    • -t: TCP connections
    • -u: UDP connections
    • -l: Listening ports only
    • -p: Show process ID (PID) and name
    • -n: Numeric output (skip DNS lookups for speed)

  2. Show established TCP connections:

    netstat -nt

  3. Display the routing table:

    netstat -rn

  4. Filter connections for a specific port:

    netstat -tulpn | grep :80

    Useful for verifying which process is using port 80 (HTTP).

2.2.3 Best Practices#

  • Combine flags for targeted output (e.g., -tulpn is a standard combination for port monitoring).
  • Use -n to avoid DNS resolution delays, especially on systems with slow or unreliable DNS.
  • Use -p only when necessary, as it exposes sensitive process information and requires root access.
  • For continuous monitoring, pipe output to watch: 
    watch netstat -tulpn
  • Consider migrating to ss -tulpn from iproute2, which is faster and provides more detailed TCP state information.

2.3 arp: Address Resolution Protocol Table Management#

2.3.1 Basic Syntax & Core Functionality#

The arp command manages the ARP table, which maps IPv4 addresses to physical (MAC) addresses on the local network. This is critical for resolving layer-2 connectivity issues.

Basic Syntax:

arp [options] [IP address]

2.3.2 Common Usage Examples#

  1. Show all ARP table entries:

    arp -a

  2. Show numeric entries (no DNS lookup):

    arp -n

  3. Delete a stale ARP entry:

    sudo arp -d 192.168.1.1

  4. Add a static ARP entry (persists until reboot):

    sudo arp -s 192.168.1.10 00:11:22:33:44:55

2.3.3 Best Practices#

  • Clear ARP cache entries only when you suspect stale or incorrect mappings (e.g., duplicate IP conflicts).
  • Use static ARP entries sparingly; they can break connectivity if the target device's MAC address changes (e.g., hardware replacement).
  • Verify static entries with arp -a and test connectivity with ping <IP>.
  • Note: The arp command only handles IPv4. For IPv6 neighbor table management, use ip -6 neigh from iproute2.

2.4 route: Routing Table Configuration & Inspection#

2.4.1 Basic Syntax & Core Functionality#

The route command manages the kernel routing table, which determines how packets are forwarded between networks.

Basic Syntax:

route [options] [add/del] [target]

2.4.2 Common Usage Examples#

  1. Show routing table (numeric output):

    route -n

    Avoids DNS lookups and speeds up output.

  2. Add a default gateway:

    sudo route add default gw 192.168.1.1 eth0

  3. Add a static route to a subnet:

    sudo route add -net 10.0.0.0 netmask 255.255.255.0 gw 192.168.1.2 eth0

  4. Delete a route:

    sudo route del -net 10.0.0.0 netmask 255.255.255.0

2.4.3 Best Practices#

  • Use -n to avoid DNS-related delays and errors when DNS is unavailable.
  • Always specify the interface (e.g., eth0) when adding routes to avoid ambiguity on multi-interface systems.
  • Test temporary routes first; for permanent changes, use distribution-specific files (e.g., /etc/network/interfaces for Debian, /etc/sysconfig/network-scripts for RHEL).

3. Migrating to iproute2: Modern Alternatives#

While net-tools is still functional on systems where it is installed, iproute2 is the modern, kernel-integrated toolset recommended for all new systems. Most Linux distributions no longer install net-tools by default, so you may need to install it manually (e.g., sudo apt install net-tools on Debian/Ubuntu or sudo dnf install net-tools on RHEL/Fedora).

Here's a quick mapping of net-tools commands to their iproute2 equivalents:

net-tools Commandiproute2 EquivalentNotes
ifconfig eth0ip addr show eth0or ip a for short
ifconfig eth0 upip link set eth0 up
ifconfig eth0 downip link set eth0 down
netstat -tulpnss -tulpnss is faster and more modern
netstat -rnip route showor ip r for short
arp -aip neigh showor ip n for short
route -nip route show
route add default gwip route add default via

Iproute2 offers more granular control, better performance, and support for modern network features like IPv6, network namespaces, and traffic control. The ss command in particular is significantly faster than netstat because it reads directly from kernel netlink sockets instead of parsing /proc/net/tcp.

4. Troubleshooting Common Scenarios with net-tools#

4.1 Diagnosing Interface Connectivity Issues#

  1. Check if the interface is active: 
    ifconfig eth0 | grep "UP BROADCAST RUNNING"
  2. If inactive, bring it up: sudo ifconfig eth0 up
  3. Verify IP assignment: ifconfig eth0 | grep "inet addr"

4.2 Identifying Unwanted Network Connections#

  1. List all listening ports: sudo netstat -tulpn
  2. Filter for suspicious ports: netstat -tulpn | grep :2222
  3. Kill the associated process: sudo kill <PID>

4.3 Resolving ARP Cache Conflicts#

  1. Check for duplicate IPs in the ARP table: arp -n
  2. Delete the conflicting entry: sudo arp -d 192.168.1.5
  3. Force re-resolution: ping 192.168.1.5

5. Frequently Asked Questions (FAQ)#

Is net-tools deprecated?#

Yes. Net-tools has been considered deprecated since the early 2000s. Its last official release was in 2001. Major distributions like Debian (since Stretch, 2016), Arch Linux, and RHEL (since version 7) have deprecated net-tools in favor of iproute2. However, it is still maintained by the community and available for installation on most distributions.

Should I stop using ifconfig and netstat?#

For new scripts and automation, yes—use ip and ss from iproute2 instead. For quick interactive troubleshooting on systems where net-tools is already installed, the commands still work fine. The key issue is that net-tools commands may not support newer kernel networking features.

Does net-tools support IPv6?#

Mostly no. The arp command only handles IPv4 neighbor entries. For IPv6, use ip -6 neigh from iproute2. Similarly, ifconfig has limited IPv6 support compared to ip addr.

How do I install net-tools on modern Linux?#

On Debian/Ubuntu: sudo apt install net-tools On RHEL/Fedora: sudo dnf install net-tools On Arch Linux: sudo pacman -S net-tools

What is the difference between netstat and ss?#

Both display network socket statistics. The ss command is the modern replacement and is faster because it queries kernel netlink sockets directly rather than parsing /proc files. The ss command also supports more filtering options and provides more detailed information about TCP states.

6. Conclusion#

Net-tools remains a valuable tool for legacy network administration and troubleshooting. Understanding its core commands (ifconfig, netstat, arp, route) is essential for maintaining older systems and scripts. However, for new infrastructure, iproute2 is the preferred choice due to its modern feature set, active maintenance, and long-term support.

By combining the best practices and examples outlined in this guide, you can efficiently diagnose and resolve network issues using net-tools, while also being prepared to transition to modern tools when needed. The migration table in Section 3 provides a quick reference for switching to iproute2 equivalents.

7. References#

2026-03