A compact network toolkit becomes powerful when each command has a specific question attached to it. ping tests IP reachability with ICMP or implementation-specific probes; traceroute reveals hop behavior; dig queries DNS; curl exercises HTTP/TLS; ss or netstat exposes local socket state. Experts combine them rather than treating any single command as proof of everything.
Remember the shape, not the sentence
“Think of each command as a medical instrument. A thermometer, pulse oximeter and X-ray answer different questions; one cannot replace the others.”
ping
Useful for testing reachability and round-trip time, but ICMP filtering means failure is not definitive proof that the application is unreachable.
traceroute
Traditional traceroute exploits TTL expiry and ICMP time-exceeded responses. Implementations vary, and some hops may not reveal themselves.
dig/curl/ss
dig isolates DNS, curl exercises the application path, and ss/netstat reveals local listeners and connection state. Together they separate layers quickly.
See the mechanism before you memorize it
One diagram, one causal story, one reconstruction task.
Hands-on: ping, traceroute, dig, curl, netstat — causal map
ping
Can the host exchange the selected probe with the destination?
traceroute
What path evidence is visible toward the destination?
dig
What does DNS return, from which resolver?
curl
Can this host complete the HTTP/TLS interaction?
Draw the idea yourself
Rebuild the core flow on a real canvas before moving to the worked walkthrough.
Walk the system
ping
Can the host exchange the selected probe with the destination?
traceroute
What path evidence is visible toward the destination?
dig
What does DNS return, from which resolver?
curl
Can this host complete the HTTP/TLS interaction?
ss
What sockets are listening or connected locally?
Command set
Use the smallest set that isolates the failure. The '-v' curl output is especially useful because it exposes DNS, TCP and TLS stages in one client-visible transcript.
ping -c 4 1.1.1.1
traceroute example.com
dig example.com
curl -vI https://example.com
ss -lntpWhat usually goes wrong
Close the tab. Rebuild it from memory.
Read the question, answer aloud, then reveal.
What does dig isolate?Reveal answer
DNS behavior and the resource-record answers returned by the selected resolver.
What does ss -lntp show on Linux?Reveal answer
Listening TCP sockets and associated process information, subject to permissions and platform differences.
Why is curl -v useful?Reveal answer
It exposes connection setup and protocol details while making a real application request.
Make this idea travel.
Connect it next to: wireshark • devtools • troubleshooting.