Linux Networking Commands Interview Questions And Answers

Linux networking commands interview questions

It’s important to have a firm understanding of both the older and more recent tools when preparing for a Linux networking interview. Your ability to handle interfaces, identify connectivity problems, and comprehend the underlying protocols are usually what interviewers look for.

Core Interface & Configuration

Q: What is the difference between ifconfig and ip?

• Answer:ifconfig (part of the net-tools package) is deprecated. The ip command (part of iproute2) is the modern replacement. ip is faster, more powerful, and can manage more than just IP addresses it handles routing, ARP (neighbor) tables, and tunnels.
  • Example: ip addr show vs ifconfig.

Q: How do you check the IP address of a specific interface?

• Answer: Use ip addr show <interface_name> (e.g., ip addr show eth0).

Q: How can you bring a network interface up or down?

• Answer:
  • Modern: ip link set eth0 up / ip link set eth0 down
  • Legacy: ifup eth0 / ifdown eth0

Connectivity & Troubleshooting

Q: A server can’t reach a website. What are the first three commands you’d run?

• Answer:
  • 1. ping <IP>: Checks basic ICMP reachability.
  • 2. dig <domain> or nslookup: Checks if DNS is resolving the hostname to an IP.
  • 3. traceroute <IP>: Identifies where the connection is dropping in the network path.

Q: What is the difference between traceroute and mtr?

• Answer: traceroute shows a static path to the destination. mtr (My Traceroute) is a real-time tool that combines ping and traceroute, showing live updates of packet loss and latency at each hop.

Also read about Networking in Linux: Types, Advantages, and Disadvantages

Q: How do you check if a specific port (e.g., 80) is open on a remote server?

• Answer:
  • telnet <IP> 80
  • nc -zv <IP> 80 (Netcat is the preferred modern tool for this).

Monitoring Sockets & Traffic

Q: How do you see all listening ports and the processes using them?

• Answer:ss -tulpn
  • -t: TCP ports
  • -u: UDP ports
  • -l: Listening sockets
  • -p: Show the Process ID (PID)
  • -n: Show numeric addresses instead of hostnames.
  • Note: This has largely replaced the older netstat -plntu.

Q: How would you capture and analyze network packets in real-time?

• Answer: tcpdump.
  • To capture traffic on a specific interface: tcpdump -i eth0.
  • To save it for later analysis in Wireshark: tcpdump -w capture.pcap.

Routing & DNS

Q: How do you view the kernel routing table?

• Answer: ip route or the older route -n.

Q: Where is the DNS resolver configuration stored in Linux?

• Answer: In the /etc/resolv.conf file. It typically contains the IP addresses of the nameservers the system queries.

Q: How do you check the ARP cache?

• Answer: Use ip neigh (modern) or arp -a (legacy). This shows the mapping of IP addresses to MAC addresses on the local segment.

Legacy vs Modern

Linux network troubleshooting commands and interview questions

Since you’re looking to ace an interview, it’s important to know not just the commands, but the why behind using them. Modern Linux networking has shifted from the old net-tools package to iproute2, and interviewers love to see if you’re up-to-date.

Troubleshooting Scenarios

Scenario A: Can’t reach the internet/another host

• The Command: ping <IP_or_Domain>
• Interview Question: “What does a successful ping tell you about the OSI model?”
• The Answer: It confirms connectivity up to the Network Layer (Layer 3). However, a failed ping doesn’t always mean the server is down; ICMP traffic might just be blocked by a firewall.

Scenario B: DNS Resolution Issues

• The Commands: dig or nslookup
• Interview Question: “A user can ping 8.8.8.8 but cannot reach google.com. What is the problem and how do you verify it?”
• The Answer: This is a classic DNS issue. I would use dig google.com to see if the system can resolve the domain name to an IP address. If it fails, I check /etc/resolv.conf.

Also read about How To Configure Network In Linux Command Line for Beginners

Scenario C: Identifying Path Latency

• The Commands: traceroute or mtr
• Interview Question: “How do you identify which hop in a network path is dropping packets?”
• The Answer: I use mtr (My Traceroute). Unlike a standard traceroute, mtr provides real-time statistics on packet loss and latency for every router in the path.

Port and Socket Management

Interviewers frequently ask about local services and ports to see if you understand how applications bind to the network.

• The Modern Command:ss -tulpn
  • -t: TCP
  • -u: UDP
  • -l: Listening sockets
  • -p: Process ID/Name
  • -n: Numeric ports (don’t resolve 80 to “http”)
• Common Question: “How do you find which process is using Port 80?”
• The Answer: ss -tulpn | grep :80 or lsof -i :80.

Configuration & Routing

You must know the ip command suite inside and out. ifconfig is widely considered “legacy” now.

Advanced Packet Analysis

If the role is for a Senior Admin or SRE, expect questions on tcpdump.

• Interview Question: “How would you capture only HTTP traffic on interface eth0 and save it to a file?”
• The Answer: tcpdump -i eth0 'port 80' -w capture.pcap
• Follow-up: “How do you read that file later?”
• The Answer: Use tcpdump -r capture.pcap or open it in Wireshark for a GUI analysis.

Critical Files to Know

Often, the “command” is just checking a text file. Be prepared to mention these:

1. /etc/hosts: Local DNS overrides.
2. /etc/resolv.conf: Nameserver (DNS) configuration.
3. /etc/nsswitch.conf: Determines the order of lookups (e.g., check hosts file before DNS).
4. /etc/network/interfaces or /etc/netplan/: Permanent interface configurations (depending on the distro).

Also read about What Is Linux Distributions (Distros)? Types And Features