Diagnostic commands by layer¶

This page lists commonly used diagnostic commands, grouped by the layer they examine, from the link up to processes and logs. Each section gives the commands, what they show, and the package that provides the tool on each distribution family. The commands are for observation: none changes configuration or service state, although some have side effects such as writing a capture file (tcpdump -w) or refreshing a neighbour entry (ping).

Placeholders used on this page:

Versions checked¶

Checked on 2026-11-07 against these versions: installed in the lab images, or offered by the distribution's repositories where a tool isn't installed by default. Gentoo was checked on an OpenRC system (OpenRC 0.63.3, sysvinit 3.15 as PID 1, netifrc 0.7.14 with dhcpcd 10.5.2, sysklogd 2.7.2); systemd-profile entries for Gentoo aren't checked in a lab.

Link¶

LOWER_UP in the flags means the physical layer reports a carrier; NO-CARRIER means it doesn't. UNKNOWN is normal for the loopback interface and some virtual interfaces that don't report a state.

Addressing¶

Addresses marked tentative are still in IPv6 duplicate address detection; dadfailed means another host already uses the address.

Package: as for ip in the link section.

Routing¶

ip route get returns RTNETLINK answers: Network is unreachable when no route matches.

Neighbours¶

Neighbour states:

DNS¶

dig status values: NOERROR (answer or empty answer), NXDOMAIN (the name doesn't exist), SERVFAIL (the server couldn't resolve it), REFUSED (the server won't answer this client).

Sockets and ports¶

A local address of 0.0.0.0:<PORT> or [::]:<PORT> means the socket accepts connections on every address; 127.0.0.1:<PORT> or [::1]:<PORT> means local connections only.

Packets¶

tcpdump captures packets on an interface and needs root privileges (or CAP_NET_RAW and CAP_NET_ADMIN).

Filter expressions (pcap-filter syntax), placed after the options:

Examples:

sudo tcpdump -i any -nn -c 20 'host 192.0.2.10 and tcp port 22'
sudo tcpdump -i any -nn 'udp port 53'
sudo tcpdump -i any -nn 'icmp or arp'
sudo tcpdump -i any -nn -w /tmp/capture.pcap 'port 443'

Firewall¶

Processes and logs¶

Processes¶

systemd journal¶

journalctl reads the systemd journal on Debian, Ubuntu, RHEL and its rebuilds, Arch, and Gentoo with the systemd profile. Root and members of the systemd-journal and adm groups can read all entries (on the RHEL family and Arch, members of wheel too); other users see only their own.

Examples:

journalctl -u sshd.service -b
journalctl -p err -b
journalctl --since "1 hour ago" -g 'timed out'
journalctl -k -b -1

Log files¶

On Gentoo with OpenRC there is no journal. Logs go to whichever syslog daemon is installed and added to the default runlevel, such as app-admin/sysklogd, app-admin/rsyslog, app-admin/syslog-ng or app-admin/metalog; the files depend on that daemon's configuration. With app-admin/sysklogd and its default /etc/syslog.conf, /var/log/syslog receives everything except authentication messages, and /var/log/messages receives only info, notice and warn messages, so look for errors in /var/log/syslog. Read the files with ordinary tools:

sudo tail -f /var/log/syslog
sudo grep -i 'error' /var/log/syslog
sudo dmesg --level=err,warn

See also¶

• ip(8), ip-route(8), ip-neighbour(8), ss(8): iproute2
• ping(8), tracepath(8): iputils
• dig(1), host(1): BIND 9 documentation
• mtr(8): mtr
• tcpdump(1), pcap-filter(7): tcpdump and libpcap
• nft(8): nftables
• journalctl(1), resolvectl(1): systemd
• ethtool(8): ethtool

Related¶

• Explanation: A troubleshooting method, and OpenRC and other init systems for why logging differs on Gentoo
• How-to: How to diagnose a host you cannot reach