> For the complete documentation index, see [llms.txt](https://www.shellspells.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.shellspells.net/linux/system-ops/network/enumerate.md).

# Enumerate

## <mark style="color:red;">NICs</mark>

<table data-header-hidden data-full-width="true"><thead><tr><th width="443">Command</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:yellow;"><code>ifconfig -a</code></mark></td><td>Prints network information/configuration.</td></tr><tr><td><mark style="color:yellow;"><code>ifconfig eth0</code></mark></td><td>Specific interface</td></tr><tr><td><mark style="color:yellow;"><code>ip addr show</code></mark></td><td>Show NIC Info</td></tr><tr><td><mark style="color:yellow;"><code>ip addr show eth0</code></mark></td><td>Specific interface</td></tr><tr><td><mark style="color:yellow;"><code>netstat -I</code></mark></td><td>Shows interface stats.</td></tr><tr><td><mark style="color:yellow;"><code>netstat -ie</code></mark></td><td>Shows interface stats, including MAC addresses.</td></tr><tr><td><mark style="color:yellow;"><code>ip link show</code></mark></td><td>Shows the state of all network interfaces.</td></tr><tr><td><mark style="color:yellow;"><code>ls /sys/class/net/</code></mark></td><td>Lists all network interfaces recognized by the kernel</td></tr><tr><td><mark style="color:yellow;"><code>lspci | grep -i network</code></mark></td><td>Lists all PCI network interfaces by searching for "network"</td></tr><tr><td><mark style="color:yellow;"><code>nmcli device status</code></mark></td><td>Lists network devices and their status using the NetworkManager command-line tool</td></tr><tr><td><mark style="color:yellow;"><code>nmtui</code></mark></td><td>Provides a text user interface to NetworkManager</td></tr><tr><td><mark style="color:yellow;"><code>ethtool &#x3C;interface></code></mark></td><td>Shows detailed info about a specific Eth interface</td></tr><tr><td><mark style="color:yellow;"><code>lshw -class network</code></mark></td><td>Detailed info on all network interfaces. Requires <mark style="color:yellow;"><code>lshw</code></mark> to be installed.</td></tr><tr><td><mark style="color:yellow;"><code>cat /sys/class/net/&#x3C;interface>/address</code></mark></td><td>Directly reads the MAC address from the system's file</td></tr></tbody></table>

### <mark style="color:purple;">Wireless</mark>

<table data-header-hidden data-full-width="true"><thead><tr><th width="438">Command</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:yellow;"><code>iwconfig</code></mark></td><td>Displays wireless network configuration.</td></tr><tr><td><mark style="color:yellow;"><code>iw dev</code></mark></td><td>Lists all wireless interfaces along with their details, including MAC addresses. Requires <mark style="color:yellow;"><code>iw</code></mark> for wireless device operations.</td></tr></tbody></table>

## <mark style="color:red;">ARP</mark>

<table data-header-hidden data-full-width="true"><thead><tr><th width="435">Command</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:yellow;"><code>arp</code></mark></td><td>Displays the current ARP table/cache for the system.</td></tr><tr><td><mark style="color:yellow;"><code>arp -a</code></mark></td><td>More readable format.</td></tr><tr><td><mark style="color:yellow;"><code>arp -an</code></mark></td><td>Print the ARP cache.</td></tr><tr><td><mark style="color:yellow;"><code>ip neigh</code></mark></td><td>Shows the ARP table. On newer systems. Part of 'iproute2'.</td></tr><tr><td><mark style="color:yellow;"><code>ip neigh show</code></mark></td><td>List the entries.</td></tr><tr><td><mark style="color:yellow;"><code>ip -s -s neigh</code></mark></td><td>Shows statistics about the ARP cache (size, entries, hits and misses).</td></tr><tr><td><mark style="color:yellow;"><code>arp-scan</code></mark></td><td>Sends ARP packets to local network to discover IP and MAC addresses. Needs install.</td></tr><tr><td><mark style="color:yellow;"><code>cat /proc/net/arp</code></mark></td><td>Displays the ARP table by reading the kernel's ARP table file.</td></tr></tbody></table>

## <mark style="color:red;">DNS</mark>

<table data-header-hidden data-full-width="true"><thead><tr><th width="435">Command</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:yellow;"><code>dig &#x3C;domain></code></mark></td><td>Queries DNS servers for info about domain names.</td></tr><tr><td><mark style="color:yellow;"><code>drill &#x3C;domain></code></mark></td><td>Similar to <mark style="color:yellow;"><code>dig</code></mark>, supports DNSSEC.</td></tr><tr><td><mark style="color:yellow;"><code>host &#x3C;domain></code></mark></td><td>Shows IP address and basic DNS information.</td></tr><tr><td><mark style="color:yellow;"><code>nslookup &#x3C;hostname/IP></code></mark></td><td>Queries Internet domain name servers for DNS lookup.</td></tr><tr><td><mark style="color:yellow;"><code>whois &#x3C;domain></code></mark></td><td>Retrieves domain registration info.</td></tr><tr><td><mark style="color:yellow;"><code>nmcli device show</code></mark></td><td>For systems using NetworkManager, includes DNS settings for network interfaces.</td></tr><tr><td><mark style="color:yellow;"><code>scutil --dns</code></mark></td><td>(macOS specific) Displays the DNS config.</td></tr><tr><td><mark style="color:yellow;"><code>cat /etc/resolv.conf</code></mark></td><td>Display DNS configuration.</td></tr><tr><td><mark style="color:yellow;"><code>cat /etc/hosts</code></mark></td><td>Display hosts file.</td></tr></tbody></table>

Shows detailed DNS config and stats for systems using <mark style="color:yellow;">`systemd-resolved`</mark> for managing network name resolution.\
It provides information about global and per-link DNS settings: <mark style="color:yellow;">`systemd-resolve --status`</mark>

Checks for DNS servers configured in network interface files (if applicable):\ <mark style="color:yellow;">`grep nameserver /etc/network/interfaces`</mark>\ <mark style="color:yellow;">`grep nameserver /etc/sysconfig/network`</mark>

## <mark style="color:red;">Routing Tables</mark>

<table data-header-hidden data-full-width="true"><thead><tr><th width="431">Command</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:yellow;"><code>netstat -rn</code></mark></td><td>Prints the kernel routing tables.</td></tr><tr><td><mark style="color:yellow;"><code>route -n</code></mark></td><td>Displays the routing table in a numerical format, making it easier to parse.</td></tr><tr><td><mark style="color:yellow;"><code>ip route show</code></mark></td><td>Lists the kernel routing tables. (Newer Linux command)</td></tr><tr><td><mark style="color:yellow;"><code>ip route list</code></mark></td><td>Similar to <mark style="color:yellow;"><code>ip route show</code>.</mark></td></tr><tr><td><mark style="color:yellow;"><code>ip route</code></mark></td><td>Displays the routing table.</td></tr><tr><td><mark style="color:yellow;"><code>ss -r</code></mark></td><td>Shows socket statistics with routing information. Not a direct way to list the routing table.</td></tr><tr><td><mark style="color:yellow;"><code>cat /proc/net/route</code></mark></td><td>Displays the routing table from the system's proc filesystem.</td></tr><tr><td><mark style="color:yellow;"><code>ip route get &#x3C;destination></code></mark></td><td>Traces the route to a specific destination.</td></tr><tr><td><mark style="color:yellow;"><code>traceroute &#x3C;hostname/IP></code></mark></td><td>Traces the path packets take to reach a host, helping to identify network bottlenecks.</td></tr><tr><td><mark style="color:yellow;"><code>mtr &#x3C;hostname/IP></code></mark></td><td>Combines <mark style="color:yellow;"><code>ping</code></mark> and <mark style="color:yellow;"><code>traceroute</code></mark> functionalities to provide continuous network diagnostics.</td></tr></tbody></table>

## <mark style="color:red;">Sockets</mark>

<table data-header-hidden data-full-width="true"><thead><tr><th width="431">Command</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:yellow;"><code>ss -auntp</code></mark></td><td>TCP connections and listeners, UDP listeners, and Processes.</td></tr><tr><td><mark style="color:yellow;"><code>netstat -auntp</code></mark></td><td>TCP connections and listeners, UDP listeners, and PIDs.</td></tr></tbody></table>

### <mark style="color:purple;">Netstat Options</mark>

<table data-header-hidden data-full-width="false"><thead><tr><th width="240">Option</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:yellow;"><code>-a</code></mark></td><td>Show both listening and non-listening sockets.</td></tr><tr><td><mark style="color:yellow;"><code>-t</code></mark></td><td>Show TCP connections.</td></tr><tr><td><mark style="color:yellow;"><code>-u</code></mark></td><td>Show UDP connections.</td></tr><tr><td><mark style="color:yellow;"><code>-n</code></mark></td><td>Show numerical addresses instead of resolving hostnames.</td></tr><tr><td><mark style="color:yellow;"><code>-l</code></mark></td><td>Show only listening sockets.</td></tr><tr><td><mark style="color:yellow;"><code>-p</code></mark></td><td>Show the PID and name of the program to which each socket belongs.</td></tr><tr><td><mark style="color:yellow;"><code>-r</code></mark></td><td>Display the routing table.</td></tr><tr><td><mark style="color:yellow;"><code>-i</code></mark></td><td>Display a table of all network interfaces.</td></tr><tr><td><mark style="color:yellow;"><code>-s</code></mark></td><td>Show statistics for all protocols.</td></tr><tr><td><mark style="color:yellow;"><code>-c</code></mark></td><td>Continuously list the information.</td></tr><tr><td><mark style="color:yellow;"><code>-W</code></mark></td><td>Avoid truncating IP addresses (useful for IPv6).</td></tr><tr><td><mark style="color:yellow;"><code>-e</code></mark></td><td>Display extended information; more detailed.</td></tr><tr><td><mark style="color:yellow;"><code>-o</code></mark></td><td>Show timer information (similar to <mark style="color:yellow;"><code>ss -o</code></mark>).</td></tr><tr><td><mark style="color:yellow;"><code>-g</code></mark></td><td>Display multicast group memberships.</td></tr><tr><td><mark style="color:yellow;"><code>-C</code></mark></td><td>Show the routing cache.</td></tr><tr><td><mark style="color:yellow;"><code>-A &#x3C;family></code></mark></td><td>Specify the address family (e.g., <mark style="color:yellow;"><code>inet</code></mark>, <mark style="color:yellow;"><code>inet6</code></mark>, <mark style="color:yellow;"><code>unix</code></mark>).</td></tr><tr><td><mark style="color:yellow;"><code>-F</code></mark></td><td>Display the Forwarding Information Base (FIB).</td></tr><tr><td><mark style="color:yellow;"><code>-M</code></mark></td><td>Display masqueraded connections.</td></tr><tr><td><mark style="color:yellow;"><code>-x</code></mark></td><td>Show UNIX domain sockets.</td></tr><tr><td><mark style="color:yellow;"><code>-Z</code></mark></td><td>Show the SELinux security context for sockets.</td></tr><tr><td><mark style="color:yellow;"><code>--numeric-hosts</code></mark></td><td>Show hosts numerically (avoid DNS lookup).</td></tr><tr><td><mark style="color:yellow;"><code>--numeric-ports</code></mark></td><td>Show ports numerically.</td></tr><tr><td><mark style="color:yellow;"><code>--numeric-users</code></mark></td><td>Show users numerically (avoid user name lookup).</td></tr><tr><td><mark style="color:yellow;"><code>--protocol=&#x3C;family></code></mark></td><td>Show information for a specific protocol family.</td></tr><tr><td><mark style="color:yellow;"><code>--tcp</code></mark></td><td>Shortcut for <mark style="color:yellow;"><code>-A inet -t</code></mark>.</td></tr><tr><td><mark style="color:yellow;"><code>--udp</code></mark></td><td>Shortcut for <mark style="color:yellow;"><code>-A inet -u</code></mark>.</td></tr><tr><td><mark style="color:yellow;"><code>--unix</code></mark></td><td>Shortcut for <mark style="color:yellow;"><code>-A unix -x</code></mark>.</td></tr><tr><td><mark style="color:yellow;"><code>--inet</code></mark></td><td>Shortcut for specifying IPv4 protocols only.</td></tr><tr><td><mark style="color:yellow;"><code>--inet6</code></mark></td><td>Shortcut for specifying IPv6 protocols only.</td></tr></tbody></table>

### <mark style="color:purple;">SS Options</mark>

<table data-header-hidden><thead><tr><th width="241">Option</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:yellow;"><code>-h</code></mark></td><td>Display help message.</td></tr><tr><td><mark style="color:yellow;"><code>-V</code></mark></td><td>Show version info.</td></tr><tr><td><mark style="color:yellow;"><code>-n</code></mark></td><td>Do not resolve service names (show numerical addresses and ports).</td></tr><tr><td><mark style="color:yellow;"><code>-r</code></mark></td><td>Resolve hostnames (inverse of -n).</td></tr><tr><td><mark style="color:yellow;"><code>-a</code></mark></td><td>Both listening and non-listening sockets.</td></tr><tr><td><mark style="color:yellow;"><code>-l</code></mark></td><td>Listening sockets only.</td></tr><tr><td><mark style="color:yellow;"><code>-o</code></mark></td><td>Show timer info.</td></tr><tr><td><mark style="color:yellow;"><code>-m</code></mark></td><td>Show memory usage for each socket.</td></tr><tr><td><mark style="color:yellow;"><code>-p</code></mark></td><td>Show process using the socket.</td></tr><tr><td><mark style="color:yellow;"><code>-i</code></mark></td><td>Show internal TCP info.</td></tr><tr><td><mark style="color:yellow;"><code>-s</code></mark></td><td>Show socket usage statistics.</td></tr><tr><td><mark style="color:yellow;"><code>-4</code></mark></td><td>IPv4 sockets only.</td></tr><tr><td><mark style="color:yellow;"><code>-6</code></mark></td><td>IPv6 sockets only.</td></tr><tr><td><mark style="color:yellow;"><code>-0</code></mark></td><td>Packet sockets only.</td></tr><tr><td><mark style="color:yellow;"><code>-t</code></mark></td><td>TCP sockets only.</td></tr><tr><td><mark style="color:yellow;"><code>-u</code></mark></td><td>UDP sockets only.</td></tr><tr><td><mark style="color:yellow;"><code>-d</code></mark></td><td>DCCP sockets only.</td></tr><tr><td><mark style="color:yellow;"><code>-w</code></mark></td><td>RAW sockets only.</td></tr><tr><td><mark style="color:yellow;"><code>-x</code></mark></td><td>Unix domain sockets only.</td></tr><tr><td><mark style="color:yellow;"><code>-f</code></mark></td><td>Specify address family (use with <mark style="color:yellow;"><code>inet</code></mark>, <mark style="color:yellow;"><code>unix</code></mark>, <mark style="color:yellow;"><code>link</code></mark>, <mark style="color:yellow;"><code>netlink</code></mark>, <mark style="color:yellow;"><code>inet6</code></mark>, etc.).</td></tr><tr><td><mark style="color:yellow;"><code>-A</code></mark></td><td>Filter sockets by states (e.g., <mark style="color:yellow;"><code>all</code></mark>, <mark style="color:yellow;"><code>connected</code></mark>, <mark style="color:yellow;"><code>synchronized</code></mark>, <mark style="color:yellow;"><code>bucket</code></mark>, <mark style="color:yellow;"><code>big</code></mark>).</td></tr><tr><td><mark style="color:yellow;"><code>-e</code></mark></td><td>Show detailed socket info.</td></tr><tr><td><mark style="color:yellow;"><code>-E</code></mark></td><td>Export socket info to a file.</td></tr><tr><td><mark style="color:yellow;"><code>-Z</code></mark></td><td>Show socket security info.</td></tr><tr><td><mark style="color:yellow;"><code>-K</code></mark></td><td>Show TCP congestion algorithm.</td></tr><tr><td><mark style="color:yellow;"><code>-c</code></mark></td><td>Show continuous listing.</td></tr><tr><td><mark style="color:yellow;"><code>-S</code></mark></td><td>Show socket details in summary format.</td></tr><tr><td><mark style="color:yellow;"><code>-b</code></mark></td><td>Show BPF filter socket info.</td></tr><tr><td><mark style="color:yellow;"><code>-N &#x3C;netns></code></mark></td><td>Switch to the specified network namespace (requires either PID or name of the netns).</td></tr><tr><td><mark style="color:yellow;"><code>-H</code></mark></td><td>Do not print header.</td></tr><tr><td><mark style="color:yellow;"><code>state &#x3C;filter></code></mark></td><td>Filter sockets by state (e.g., <mark style="color:yellow;"><code>established</code></mark>, <mark style="color:yellow;"><code>time-wait</code></mark>).</td></tr></tbody></table>

## <mark style="color:red;">Connectivity</mark>

<table data-header-hidden data-full-width="true"><thead><tr><th width="353">Command</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:yellow;"><code>ping &#x3C;hostname/IP></code></mark></td><td>Tests connectivity to a host and measures round-trip time.</td></tr><tr><td><mark style="color:yellow;"><code>traceroute &#x3C;hostname/IP></code></mark></td><td>Traces the path packets take to reach a host, helping identify network bottlenecks.</td></tr><tr><td><mark style="color:yellow;"><code>mtr &#x3C;hostname/IP></code></mark></td><td>Combines <mark style="color:yellow;"><code>ping</code></mark> and <mark style="color:yellow;"><code>traceroute</code></mark> functionalities.</td></tr><tr><td><mark style="color:yellow;"><code>nc &#x3C;hostname/IP> &#x3C;port></code></mark></td><td>Tests TCP connectivity to a specified port on a host.</td></tr><tr><td><mark style="color:yellow;"><code>telnet &#x3C;hostname/IP> &#x3C;port></code></mark></td><td>Attempts to establish a TCP connection to a specified port on a host.</td></tr><tr><td><mark style="color:yellow;"><code>curl &#x3C;URL></code></mark></td><td>Retrieves content from a web server, useful for testing HTTP connectivity.</td></tr><tr><td><mark style="color:yellow;"><code>host &#x3C;hostname></code></mark></td><td>Simple utility for DNS lookups.</td></tr><tr><td><mark style="color:yellow;"><code>iperf / iperf3</code></mark></td><td>Measures the maximum network bandwidth between a client and a server.</td></tr></tbody></table>

## <mark style="color:red;">Processes Using Network</mark>

<table data-header-hidden data-full-width="false"><thead><tr><th width="284">Command</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:yellow;"><code>lsof -i</code></mark></td><td>Lists open files belonging to active network connections.</td></tr><tr><td><mark style="color:yellow;"><code>sudo lsof -i tcp:&#x3C;port></code></mark></td><td>Lists processes using a specific TCP port.</td></tr><tr><td><mark style="color:yellow;"><code>sudo lsof -i udp:&#x3C;port></code></mark></td><td>Lists processes using a specific UDP port.</td></tr><tr><td><mark style="color:yellow;"><code>netstat -tupln</code></mark></td><td>Shows the PID and program name that are listening.</td></tr><tr><td><mark style="color:yellow;"><code>ss -tupln</code></mark></td><td>Shows the PID and program name that are listening.</td></tr><tr><td><mark style="color:yellow;"><code>nethogs</code></mark></td><td>Displays real-time network usage per process.</td></tr></tbody></table>

### <mark style="color:purple;">Find Processes Using a Specific Port</mark>

Use with caution as it sends signals to processes and could affect their behavior:

<table data-header-hidden><thead><tr><th width="280">Command</th><th>Description</th></tr></thead><tbody><tr><td><mark style="color:yellow;"><code>fuser &#x3C;port></code></mark></td><td>Provides PID</td></tr><tr><td><mark style="color:yellow;"><code>fuser -nv tcp &#x3C;port></code></mark></td><td>Identifies processes using a specific TCP port</td></tr><tr><td><mark style="color:yellow;"><code>fuser -nv udp &#x3C;port></code></mark></td><td>Identifies processes using a specific UDP port.</td></tr></tbody></table>

### <mark style="color:purple;">Find Processes that have Port Information</mark>

```bash
pfiles \ `ptree | awk '{print $1}'\`| egrep '^[0-9]|port:'
```

Captures TCP packets with SYN or ACK flags, indicating connection attempts. Requires root privileges:

```bash
tcpdump -i <interface> -n 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0'
```

Sets up a rule in iptables to log network connections initiated by processes owned by a specific user. This requires analyzing the log to see the connections:

```bash
iptables -A OUTPUT -m owner --uid-owner <user> -j LOG
```

## <mark style="color:red;">Solaris</mark>

<mark style="color:yellow;">`netstat -anP tcp`</mark>\ <mark style="color:yellow;">`netstat -anP udp`</mark>\ <mark style="color:yellow;">`pfiles /proc/`</mark>\ <mark style="color:yellow;">``pfiles `ptree | awk '{print $1}'`| egrep '^[0-9]|port:' >> /tmp/ports rpcinfo -p``</mark>