learn/network-plus/platforms
53 differences from 16 topics, in reading order. The exam is vendor-neutral and names three host tools for the same job, so it will ask for the result rather than the command you happen to know. These are the places where the answer has a different name depending on where you type it. Each table links back to the topic that explains why the difference is there.
What a network actually is
| The question | Linux | Windows | macOS | |
|---|---|---|---|---|
| Is the interface enabled, and is anything on the other end | ip -brief link show | ipconfig, then netsh interface show interface | ifconfig | |
| Does it have an address, and what is the mask | ip -brief addr show | ipconfig | ifconfig | |
| Has this machine actually spoken to the other one | ip neigh show | arp -a | arp -a |
MACs, IPs and ports
| Linux | Windows | macOS | |
|---|---|---|---|
| Interface and MAC | ip link show | ipconfig /all | ifconfig |
| Address and mask | ip addr show | ipconfig | ifconfig |
| Neighbour table | ip neigh show | arp -a | arp -a |
| Routing table | ip route | route print | netstat -rn |
| Listening ports | ss -tlnp | netstat -ano | netstat -an |
IPv4 addresses and the mask
| Linux | Windows | macOS | |
|---|---|---|---|
| Show the address and its mask | ip -brief addr show | ipconfig | ifconfig en0 |
| The notation you get | 192.168.10.1/24 | 255.255.255.0 | 0xffffff00 |
| Get a prefix length | it is already one | Get-NetIPAddress | convert it yourself |
| Get dotted decimal | convert it yourself | it is already one | ipconfig getoption en0 subnet_mask |
Address classes, private ranges and APIPA
| Linux | Windows | macOS | |
|---|---|---|---|
| Reach 127.0.0.1 | works | works | works |
| Reach anything else in 127.0.0.0/8 | works | works | times out |
| Show what covers the block | ip route show table local | Get-NetIPAddress -InterfaceAlias "Loopback*" | ifconfig lo0 |
IPv6 addressing
| Linux | Windows | macOS | |
|---|---|---|---|
| List the IPv6 addresses | ip -6 addr | Get-NetIPAddress -AddressFamily IPv6 | ifconfig en0 |
| Scope a link-local address | %eth0, named | %14, a zone index | %en0, named |
| See how the identifier was made | look for ff:fe in it | the SuffixOrigin column | the secured flag |
TCP, UDP and the handshake
| Linux | Windows | macOS | |
|---|---|---|---|
| Every TCP connection | ss -tan | netstat -ano -p TCP | netstat -an -p tcp |
| Per-connection counters | ss -ti | Get-NetTCPConnection | netstat -s -p tcp for totals |
| Owning process | ss -tanp | netstat -ano, then match the PID | lsof -i |
Ports and the protocols that use them
| Linux | Windows | macOS | |
|---|---|---|---|
| Where the file lives | /etc/services, from netbase on Debian | %SystemRoot%\System32\drivers\etc\services | /etc/services |
| Look up a port number | grep -w 443/tcp /etc/services | Select-String "^https\s" | grep -w 443/tcp /etc/services |
| Look up a service name | getent services ssh | Select-String "^ssh\s" | grep -E "^ssh[[:space:]]" /etc/services |
The routing table and static routes
| Linux | Windows | macOS | |
|---|---|---|---|
| Show the table | ip route | route print -4 | netstat -rn -f inet |
| The decision for one destination | ip route get 10.0.2.2 | Find-NetRoute -RemoteIPAddress 10.0.2.2 | route -n get 10.0.2.2 |
| Add a static route | ip route add | route add or New-NetRoute | route add |
Time protocols
| Linux | Windows | macOS | |
|---|---|---|---|
| Which server this machine asks | chronyc sources | w32tm /query /source | systemsetup -getnetworktimeserver |
| Whether it is synchronised | timedatectl | w32tm /query /status | systemsetup -getusingnetworktime |
| Query a server without touching the clock | chronyc ntpdata | w32tm /stripchart /computer:<host> | sntp <host> |
Interface counters and port status
| Linux | Windows | macOS | |
|---|---|---|---|
| Errors and drops on a port | ip -s -s link show <if> | netstat -e, Get-NetAdapterStatistics | netstat -i |
| Whether a port has a link | ip link show <if>, read NO-CARRIER | Get-NetAdapter, read MediaConnectionState | ifconfig <if>, read status: |
| The speed it settled on | ethtool <if> | Get-NetAdapter, read LinkSpeed | ifconfig <if>, read media: |
Routing and default gateway faults
| Linux | Windows | macOS | |
|---|---|---|---|
| Show the routing table | ip route show | route print, Get-NetRoute | netstat -rn |
| Ask which route wins | ip route get <dest> | Find-NetRoute -RemoteIPAddress <dest> | route -n get <dest> |
| Read the neighbour table | ip neigh show | arp -a, Get-NetNeighbor | arp -an |
| Trace the path | traceroute -n | tracert -d | traceroute -n |
Addressing faults
| Linux | Windows | macOS | |
|---|---|---|---|
| Read the address and mask | ip -br addr show | ipconfig, Get-NetIPAddress | ifconfig <if> |
| Read who owns an address locally | ip neigh show | arp -a, Get-NetNeighbor | arp -an |
| Read the current lease | cat /var/lib/dhcp/dhclient.leases | ipconfig /all | ipconfig getpacket <if> |
Wireless performance and roaming
| Linux | Windows | macOS | |
|---|---|---|---|
| Signal, noise and rate of the current link | iw dev <if> link | netsh wlan show interfaces | wdutil info |
| Retries and per-station counters | iw dev <if> station dump | netsh wlan show interfaces | wdutil info |
| What else is on the air nearby | iw dev <if> scan | netsh wlan show networks mode=bssid | wdutil info |
Packet capture and protocol analysis
| Linux | Windows | macOS | |
|---|---|---|---|
| Capture with a filter | tcpdump -n -i <if> "<filter>" | pktmon filter add then pktmon start --capture | sudo tcpdump -n -i <if> "<filter>" |
| Read the capture back | prints as it goes, or tcpdump -r <file> | pktmon etl2txt <file> | prints as it goes, or tcpdump -r <file> |
| Stop resolving names | -n | not applicable, it prints addresses | -n |
Discovery tools and device commands
| Linux | Windows | macOS | |
|---|---|---|---|
| Find hosts on a range | nmap -sn <range> | nmap -sn <range>, Test-NetConnection | nmap -sn <range> |
| Find open ports on a host | nmap <host> | nmap <host>, Test-NetConnection -Port | nmap <host> |
| Read neighbour announcements | lldpcli show neighbors | Get-NetNeighbor for addresses only | tcpdump filtered to the protocol |
How the internet is glued together
| Linux | Windows | macOS | |
|---|---|---|---|
| Who holds an AS number | dig +short ASnnnn.asn.cymru.com TXT | Resolve-DnsName -Type TXT | dig, as Linux |
| Which prefix and origin an address has | the same, against origin.asn.cymru.com | the same cmdlet | dig, as Linux |
| Whether an announcement is authorised | curl piped into jq | Invoke-RestMethod | curl piped into python3 |
| Read a network's published policy | whois -h whois.ripe.net -p 43 | no client by default, so the registry's web interface | whois ships with the system |