TCP/IP Configuration Commands for UNIX/Linux, MacOS X, Windows, and Cisco IOS

Alpha DS10 and Alphastation 200 4/233 servers running Linux and OpenBSD Unix.  The DEC Alpha servers are providing high-speed network services, as web servers and file servers.

AlphaServer DS10 and AlphaStation 200 4/233 running Linux and OpenBSD Unix.

The following commands will report the TCP/IP configuration on Unix, MacOS X, Windows, and Cisco operating systems. By "Unix" I mean anything vaguely Unix-like — Solaris, Linux, BSD, Tru64, AIX, IRIX, HP-UX, etc., plus MacOS X.

Note that the Cisco IOS allows for command abbreviation. That is, instead of:
router> show interfaces
you could simply type:
router> sh in
However, I prefer to use the entire command, using the tab key for command completion. You type just sh and then press <tab>:
router> sh<tab>
and the system finishes the command itself:
router> show
At that point you could press ? to see what alternatives are available (in the case of the show command, quite a few!), and then type enough of the parameter to be unambiguous:
router> show in<tab>
and it finishes the parameter for you:
router> show interfaces
Only two more key presses and you get a clear explanation of what it's doing. More importantly, your typing errors become much more obvious!

Cisco Catalyst 2924 XL switch, forwarding Ethernet frames at the Physical and Link-Layer Control layers.

Cisco Catalyst 2900 XL switch.

LAN Information (OSI Layer 1 and 2)

Display the interface statistics (packets received and sent, errors, collisions, maybe the rate of packets or bytes per second, maybe the MAC addresses)

Unix and MacOS X netstat -i
Linux% netstat -i
Kernel Interface table
Iface  MTU Met    RX-OK RX-ERR RX-DRP RX-OVR    TX-OK TX-ERR TX-DRP TX-OVR Flg
eth0  1500   0 46249635      0      0      0 46076591      0      0      3 BMRU
eth1  1500   0   780201      2      2      2   774526      0      0      8 BMRU
lo   16436   0   755482      0      0      0   755482      0      0      0 LRU

BSD and MacOS X, adding -n to leave addresses numeric. Following example from an OpenBSD laptop:
lo0 = Loopback pseudo-device
sis0 = Ethernet
enc0 = Encapsulation pseudo-device
BSD/MacOS% netstat -i -n
Name    Mtu   Network     Address              Ipkts Ierrs    Opkts Oerrs Colls
lo0     33208 <Link>                              12     0       12     0     0
lo0     33208 127/8       127.0.0.1               12     0       12     0     0
lo0     33208 ::1/128     ::1                     12     0       12     0     0
lo0     33208 fe80::%lo0/ fe80::1%lo0             12     0       12     0     0
sis0    1500  <Link>      00:11:43:44:8a:9b     1522     0      899     0     0
sis0    1500  fe80::%sis0 fe80::211:43ff:fe     1522     0      899     0     0
sis0    1500  10.1.1/24   10.1.1.230            1522     0      899     0     0
enc0*   1536  <Link>                               0     0        0     0     0
Windows netstat -e
C:\>netstat -e
Interface Statistics
                      Received        Sent
Bytes                  1160647      105766
Unicast packets            858         200
Non-unicast packets         70          45
Discards                     0           0
Errors                       0           0
Unknown protocols            0 
Cisco show interfaces
router> show interfaces ethernet 0
Ethernet0 is up, line protocol is up
  Hardware is Lance, address is 0000.0c8e.b534 (bia 0000.0c8e.b534)
  Internet address is 10.1.1.254/24
  MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, rely 255/255, load 2/255
  Encapsulation ARPA, loopback not set, keepalive set (10 sec)
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:00, output 00:00:00, output hang never
  Last clearing of "show interface" counters never
  Queueing strategy: fifo
  Output queue 0/40, 0 drops; input queue 1/75, 0 drops
  5 minute input rate 108000 bits/sec, 18 packets/sec
  5 minute output rate 107000 bits/sec, 18 packets/sec
     6080 packets input, 4156592 bytes, 0 no buffer
     Received 869 broadcasts, 0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
     0 input packets with dribble condition detected
     5858 packets output, 4036087 bytes, 0 underruns
     0 output errors, 0 collisions, 10 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out

Display the interface media settings and options (RJ-45 vs AUI interface, media speed and duplex settings, MTU, etc)

Linux ethtool interface-name-here
Linux# ethtool eth0
Settings for eth0:
        Supported ports: [ TP MII ]
        Supported link modes:   10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
        Supports auto-negotiation: Yes
        Advertised link modes:  10baseT/Half 10baseT/Full
                                100baseT/Half 100baseT/Full
        Advertised auto-negotiation: Yes
        Speed: 100Mb/s
        Duplex: Full
        Port: MII
        PHYAD: 32
        Transceiver: internal
        Auto-negotiation: on
        Supports Wake-on: pumbg
        Wake-on: d
        Current message level: 0x00000007 (7)
	Link detected: yes 
BSD and MacOS X ifconfig -m

or, depending on version

ifconfig interface-name-here media
BSD/MacOS% ifconfig sis0 media
sis0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:11:43:44:8a:9b
        groups: egress
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        supported media:
                media 10baseT
                media 10baseT mediaopt full-duplex
                media 100baseTX
                media 100baseTX mediaopt full-duplex
                media autoselect
        inet6 fe80::211:43ff:fe44:8a9b%sis0 prefixlen 64 scopeid 0x1
	inet 10.1.1.230 netmask 0xffffff00 broadcast 10.1.1.255 
Cisco show interfaces See the example in the above section.

Display the ARP cache

Unix and MacOS X arp -a
% arp -a
somehost.example.com (192.168.12.230) at 00:11:43:44:8A:9B [ether] on eth0
otherhost.example.com (192.168.12.230) at 00:11:43:37:C2:21 [ether] on eth0
router.example.com (192.168.12.1) at 00:01:5C:24:85:02 [ether] on eth0
Windows arp -a
Cisco show arp
Rack of Ethernet switches.

Rack of Ethernet switches.

LAN Troubleshooting and Configuration

There should be no collisions on a switched LAN. If you do see collisions, suspect problems with the negotiation of speed and duplex mode. Some kernel modules (device drivers) may auto-negotiate by default, but then have an option to force auto-negotiation that causes slightly different behavior and results. Experiment!

To set the speed and duplex mode, you could run the appropriate ethtool or ifconfig media command immediately after booting, perhaps through /etc/rc.local. The problem is that the interface would have already come up in an inappropriate mode and networking would have to be restarted, especially if you are using DHCP.

A better solution would be to load the kernel module with the appropriate optional parameter. On Linux, see the kernel documentation for the driver-specific options. The details should be in /usr/src/linux/Documentation/networking/driver-name*, although at times you have to look at the source code itself, /usr/src/linux/drivers/net/driver-name*. Once you find the appropriate parameters, specify them as option lines in /etc/modprobe.conf.

On BSD, add the appropriate fields to the /etc/hostname.interface file, the options will be applied when the kernel first brings up the interface. For example:

$ cat /etc/hostname.sis0
10.1.1.230 netmask 255.255.255.0 media 100baseT mediaopt full-duplex 

If there are significant numbers of errors other than collisions, suspect problems with the Ethernet cables (most likely) or possibly the system's Ethernet card or the switch port.

IP Information (OSI Layer 3)

Display the current IP configuration (IP address, netmask) for the interfaces

Unix and MacOS X ifconfig -a An example from a Linux system with two Ethernet interfaces, eth0 and eth1, the second of which has two virtual interface configurations:
% ifconfig -a
eth0      Link encap:Ethernet  HWaddr 00:11:95:1E:8E:B6
          inet addr:98.228.31.224  Bcast:255.255.255.255  Mask:255.255.248.0
          inet6 addr: fe80::211:95ff:fe1e:8eb6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:46932082 errors:0 dropped:0 overruns:0 frame:0
          TX packets:46814984 errors:0 dropped:0 overruns:8 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:809855308 (772.3 MiB)  TX bytes:2776351401 (2.5 GiB)
          Interrupt:21 Base address:0xa000

eth1      Link encap:Ethernet  HWaddr 00:0D:61:B1:86:53
          inet addr:10.1.1.100  Bcast:10.1.1.255  Mask:255.255.255.0
          inet6 addr: fe80::20d:61ff:feb1:8653/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:789491 errors:3 dropped:3 overruns:3 frame:0
          TX packets:785514 errors:0 dropped:0 overruns:15 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:234930278 (224.0 MiB)  TX bytes:342684110 (326.8 MiB)
          Interrupt:19 Base address:0x8000

eth1:0    Link encap:Ethernet  HWaddr 00:0D:61:B1:86:53
          inet addr:10.0.0.100  Bcast:10.0.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:19 Base address:0x8000

eth1:1    Link encap:Ethernet  HWaddr 00:0D:61:B1:86:53
          inet addr:10.1.0.254  Bcast:10.1.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          Interrupt:19 Base address:0x8000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:760670 errors:0 dropped:0 overruns:0 frame:0
          TX packets:760670 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:676142037 (644.8 MiB)  TX bytes:676142037 (644.8 MiB)

sit0      Link encap:IPv6-in-IPv4
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
	  RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
Windows ipconfig /all
C:\>ipconfig /all
Windows IP Configuration

        Host Name . . . . . . . . . . . . : WINXP
        Primary Dns Suffix  . . . . . . . :
        Node Type . . . . . . . . . . . . : Unknown
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : example.com

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : VMware Accelerated AMD PCNet Adapter
        Physical Address. . . . . . . . . : 00-0C-29-A4-AE-C9
        Dhcp Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 10.1.1.222
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 10.1.1.100
	DNS Servers . . . . . . . . . . . : 10.1.1.100 
Cisco show ip config
or
show running-config
or
show protocols
or
show interfaces
router> show protocols
Global values:
  Internet Protocol routing is enabled
Ethernet0 is up, line protocol is up
  Internet address is 10.1.1.254/24
Ethernet1 is up, line protocol is up
  Internet address is 192.168.1.254/24
Serial0 is administratively down, line protocol is down
Serial1 is administratively down, line protocol is down 

Display the current routing table

Unix and MacOS X netstat -nr Output from the same Linux machine with following IP addresses:
eth0    98.228.31.224/21
eth1    10.1.1.100/24
eth1:0  10.1.0.100/24
eth1:1  10.1.0.254/24

Linux% netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.0.0.0        0.0.0.0         255.255.255.0   U         0 0          0 eth1
10.1.1.0        0.0.0.0         255.255.255.0   U         0 0          0 eth1
98.228.24.0     0.0.0.0         255.255.248.0   U         0 0          0 eth0
10.1.0.0        0.0.0.0         255.255.0.0     U         0 0          0 eth1
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth1
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth0
0.0.0.0         98.228.24.1     0.0.0.0         UG        0 0          0 eth0
Flags:
U = Up
G = Gateway

Add -f inet to see IPv4 only on BSD and MacOS X, otherwise you see voluminous IPv6 routing information:
BSD/MacOS% netstat -nr
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use    Mtu  Interface
default            10.1.1.100         UGS         4      688      -   sis0
10.1.1/24          link#1             UC          1        0      -   sis0
10.1.1.100         00:0d:61:b1:86:53  UHLc        2      346      -   sis0
10.1.1.230         127.0.0.1          UGHS        0        0  33208   lo0
127/8              127.0.0.1          UGRS        0        0  33208   lo0
127.0.0.1          127.0.0.1          UH          2       12  33208   lo0
224/4              127.0.0.1          URS         0        0  33208   lo0 
Flags:
U = Up
G = Gateway
S = Static, e.g., default route added at boot time
H = Host-specific
C = Generate new (host-specific) routes on use
L = Valid link-layer (MAC) address
c = Cloned route
R = Reject route, known but unreachable route
Windows netstat -nr
C:\>netstat -nr
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10003 ...00 0c 29 a4 ae c9 ...... AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0       10.1.1.100      10.1.1.222	  10
         10.1.1.0    255.255.255.0       10.1.1.222      10.1.1.222	  10
       10.1.1.222  255.255.255.255        127.0.0.1       127.0.0.1	  10
   10.255.255.255  255.255.255.255       10.1.1.222      10.1.1.222	  10
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1	  1
        224.0.0.0        240.0.0.0       10.1.1.222      10.1.1.222	  10
  255.255.255.255  255.255.255.255       10.1.1.222      10.1.1.222	  1
Default Gateway:        10.1.1.100
===========================================================================
Persistent Routes:
  None

Route Table
Cisco show ip route
router> show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, * - candidate default
       U - per-user static route, o - ODR

Gateway of last resort is 10.1.1.100 to network 0.0.0.0

     10.0.0.0/24 is subnetted, 1 subnets
C       10.1.1.0 is directly connected, Ethernet0
C    192.168.1.0/24 is directly connected, Ethernet1
S*   0.0.0.0/0 [1/0] via 10.1.1.100

See the page "How Routing Works" for an explanation of IP routing and example output.

IP Configuration

On BSD, configure the interface in /etc/hostname.name and the default gateway in /etc/mygate:

% cat /etc/hostname.sis0 
inet 192.168.250.219 255.255.255.0 NONE
% cat /etc/mygate 
192.168.250.1 

On most Linux distributions, configure the interface in /etc/sysconfig/network-scripts/ifcfg-name and the default gateway in /etc/sysconfig/network:

% cat /etc/sysconfig/network-scripts/ifcfg-eth1
DEVICE=eth1
BOOTPROTO=static
IPADDR=192.168.250.219
NETMASK=255.255.255.0
## Always comment out the unneeded BROADCAST and NETWORK entries
## added by Red Hat's installation tools!  If you leave them in,
## and later you make manual changes that are the least bit
## contradictory, strange problems will occur!
# BROADCAST=192.168.250.255
# NETWORK=192.168.250.0
## Also comment out the unneeded HWADDR entry added by Red Hat's
## installation tool!  If you leave it in, and then change your
## Ethernet card, your networking will mysteriously fail.
# HWADDR=00:03:47:76:23:F8
% cat /etc/sysconfig/network
HOSTNAME=whatever.example.com
NETWORKING=yes 

On Debian/Ubuntu Linux, configure the interface in and default gateway in /etc/network/interfaces:

% cat interfaces 
auto lo
iface lo inet loopback

iface eth0 inet static
address 192.168.250.219
netmask 255.255.255.0
gateway 192.168.250.1

auto eth0 

Use traceroute to trace the hop-by-hop route to a destination

Unix and MacOS X traceroute 195.242.3.1
Windows tracert 195.242.3.1
Cisco trace
You will then be asked to enter the target IP address.

The output will resemble something like the following, with one line per router along the way, and three probes to each router. Note that many web servers today silently drop traceroute probes, so you will see the trace to the last router and dropped packets (stars) beyond that. Also remember that most organizations pay a company to host their web server at an entirely different point in the Internet topology than their main operation. For example, www.pentagon.mil is hosted by Akamai, which means that many mirrors of it are distributed around the Internet, none of them at the five-sided building in Washington DC. Here's a trace from Indiana to Moscow:

$  traceroute www.fsb.ru
traceroute to www.fsb.ru (213.24.76.23), 30 hops max, 40 byte packets
 1  itns-core-vss-01-vlan444.ecn.purdue.edu (128.46.144.1)  0.450 ms  0.436 ms  0.473 ms
 2  tel-210-c7609s-01-po1.tcom.purdue.edu (172.28.252.14)  0.349 ms  0.354 ms  0.353 ms
 3  indiana-gigapop-ctc-internet-mx960.tcom.purdue.edu (192.5.40.179)  1.375 ms  1.396 ms  1.419 ms
 4  xe-0-2-0.111.rtr.ll.indiana.gigapop.net (149.165.254.22)  1.506 ms  1.459 ms  1.464 ms
 5  xe-0-2-0.111.rtr.atla.net.internet2.edu (149.165.254.23)  16.586 ms  16.578 ms  16.583 ms
 6  xe-1-0-0.0.rtr.wash.net.internet2.edu (64.57.28.59)  30.242 ms  30.243 ms  30.212 ms
 7  xe-2-0-0.0.rtr.newy32aoa.net.internet2.edu (64.57.28.74)  35.432 ms  35.428 ms  35.376 ms
 8  ge5-3-0-1000M.ar1.SJC2.gblx.net (64.208.110.25)  35.596 ms  35.602 ms  35.593 ms
 9  PO1-20G.ar1.ARN3.gblx.net (67.17.109.213)  141.805 ms  142.065 ms  142.187 ms
10  RT-COMM-RU-OJSC.Port-channel2.463.ar1.ARN3.gblx.net (64.213.54.50)  144.452 ms  144.487 ms  144.472 ms
11  195.161.47.126 (195.161.47.126)  157.495 ms  155.553 ms *
12  213.59.2.62 (213.59.2.62)  155.583 ms  155.199 ms  157.258 ms
13  * * *
14  * * *
15  * * *
16  * * *
Rack of Cisco routers.

Rack of Cisco routers. Most are 3600 series routers, the brown one near the bottom is a 2500 series. The network connections on on the opposite side, the single cable to each router is a connection to its console port.

Hops 1-3: Across Purdue University's networks and to an Internet2 gateway in Indianapolis. Fractions of milliseconds to get across campus, just over 1 millisecond to get to Indianapolis, maybe 150 km away along the fiber route.

Hops 3-7: Across the internet2.edu very high speed backbone. Interpreting the router names: Indianapolis IN; Atlanta GA; Washington DC; New York NY. Notice the IN-GA and GA-DC hops add about 15 milliseconds each, and DC-NY adds about another 5 msec.

Hops 8-10: Across the Global Crossing gblx.net world-wide backbone. Notice how much time gets added from hops 8 to 9, compared to the time for hops 1-10. Hop #11 crosses the Atlantic by fiber, and the speed of light is a hard speed limit.

Hops 11-12: Two hops within Russia, probably within Moscow.

Hops 13 and beyond: One possibility is that a firewall is hop 13 and it is silently dropping the arriving traceroute probes, and the server would then be hop 14. Another possibility is that the server itself is hop 13 and it is silently dropping the packets.

UDP/TCP Information (OSI Layer 4)

Display all TCP connections and listening ports

Unix and MacOS X netstat -a
Note — check the manual page for your version of netstat to find the option to only show TCP/IP and leave out the possibly voluminous UNIX domain socket information. It's probably -f inet or -A inet, and -f inet6 or -A inet6 if you're running IPv6.
Windows netstat -a
Cisco show tcp

General Information

Display TCP/IP statistics (or counters)

Unix and MacOS X netstat -s
Windows netstat -s
Cisco show interfaces
show ip traffic

Other Pages

How to break in, initialize, and configure a Cisco router

How to program Cisco Catalyst and 3com 3000 switches

Cisco Catalyst 2900 XL Ethernet switch disassembly and repair

Network and Telecommunication Cables

Back to the main TCP/IP networking page.

Click here to inquire about advertising on this or any page on this site.
Home Unix/Linux Networking Infosec Travel Technical Radio Site Map Contact
Use /bin/vi! Manipulate images with ImageMagick! Hosted on OpenBSD
Hosted on Apache This site is viewable with any browser Valid XHTML 1.0! Valid CSS!
© Bob Cromwell Sep 2010. Created with /bin/vi and ImageMagick, hosted on OpenBSD with Apache.    Root password available here, privacy policy here.