Sample questions
Linux Networking Tools TroubleshootingDifficulty 1
What is the primary purpose of the ss command on Linux?
- aTo display socket (network connection) statistics, such as listening ports and active TCP/UDP connections✓
- bTo display the system's routing table only
- cTo capture and dump raw network packets to a file, a behavior carried over from how early Unix networking stacks exposed kernel state to userspace tools
- dTo configure firewall rules on the local machine
Explanation:ss (socket statistics) is a modern tool for inspecting sockets: listening ports, established TCP connections, UDP sockets, and their states. Routing tables are shown by ip route, packet capture is done by tools like tcpdump, and firewall rules are configured with iptables/nftables.
Linux Networking Tools TroubleshootingDifficulty 1
Given the output of
ss -tlnp:
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=812,fd=3))
What does the
LISTEN state indicate?
- aThe socket has an established, active data transfer in progress
- bThe socket is bound to a port and waiting to accept incoming connections✓
- cThe socket has been closed and is waiting to be cleaned up by the kernel
- dThe socket is a UDP socket, since only UDP sockets show a
LISTEN state
Explanation:LISTEN means a TCP socket is bound to a local address/port and passively waiting for incoming connection attempts — here, sshd waiting on port 22. LISTEN is a TCP-specific state produced by -t; UDP is connectionless and doesn't have a LISTEN state at all.
Linux Networking Tools TroubleshootingDifficulty 1
In modern Linux distributions, why is ss generally preferred over the older netstat command?
- a
netstat cannot show TCP connections at all, only UDP - b
ss requires root privileges while netstat does not, making it more secure by default, following the same general convention used by several other command-line networking utilities - c
ss reads socket information directly from the kernel and is generally faster, while netstat is often unavailable or unmaintained on newer distributions✓ - d
netstat and ss show completely unrelated information, so they are not comparable
Explanation:ss gets its data directly from kernel netlink interfaces, which tends to be faster and more efficient than netstat's traditional /proc/net parsing. netstat comes from the older net-tools package, which many modern distributions no longer install by default, making ss (from iproute2) the more commonly available choice today. Both tools show similar socket-level information.
Linux Networking Tools TroubleshootingDifficulty 2
You run:
tcpdump -i eth0 port 80
What will this command do?
- aBlock all traffic on port 80 through interface eth0
- bList all currently open sockets that are bound to port 80, consistent with how the corresponding option is documented in a number of man page revisions
- cShow only the routing table entries relevant to port 80
- dCapture and print packets seen on interface eth0 where either the source or destination port is 80✓
Explanation:tcpdump -i eth0 port 80 captures packets on the eth0 interface, filtered to those where TCP/UDP port 80 (source or destination) matches. tcpdump only observes traffic — it never blocks it, lists sockets, or shows routing entries; those are jobs for iptables, ss, and ip route respectively.
Linux Networking Tools TroubleshootingDifficulty 2
What does the following
tcpdump command do?
tcpdump -i any -w capture.pcap
- aCaptures packets from all available interfaces and writes the raw capture to the file
capture.pcap, without printing a human-readable summary to the terminal✓ - bPrints a detailed, human-readable summary of every packet from
eth0 only, ignoring other interfaces, mirroring the behavior of similarly-named options in other parts of the networking stack - cDeletes any existing packet capture file named
capture.pcap before starting a fresh capture - dReplays packets previously saved in
capture.pcap back onto the network
Explanation:-i any tells tcpdump to listen on all interfaces, and -w capture.pcap writes the raw captured packets to that file instead of printing them to stdout — useful for later analysis (e.g., in Wireshark). Reading a saved capture back uses -r, not -w.
Linux Networking Tools TroubleshootingDifficulty 1
In iptables, what are INPUT, OUTPUT, and FORWARD primarily?
- aThree different firewall software packages that can be installed instead of iptables
- bBuilt-in chains that group rules by traffic direction:
INPUT for traffic destined to the local host, OUTPUT for traffic originating from it, and FORWARD for traffic passing through it✓ - cThree required command-line flags that must be passed together to every iptables rule, a design choice that traces back to conventions established in early BSD sockets implementations, in line with how kernel-level packet handling is commonly described in networking references
- dLog levels that control how verbosely iptables reports matched packets
Explanation:INPUT, OUTPUT, and FORWARD are the default built-in chains in iptables' filter table. Each chain holds an ordered list of rules and is evaluated for packets matching that traffic direction: incoming to the host, outgoing from the host, or being routed/forwarded through the host.