:: show all interface settings
ipconfig /all

:: display ARP cache
arp -a
arp -d 192.168.0.4 # delete ARP cache entry

:: set DHCP on device "Ethernet"
netsh interface ip set address "Ethernet" dhcp

route print
::        destination        mask          gateway          interface
route add 192.168.100.0 mask 255.255.255.0 192.168.100.1 if 2

$MyPat = 'yourPAT'
$B64Pat = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("`:$MyPat"))

Resolve-DnsName -Name example.com -Type A -Server 8.8.8.8

# ping test
tnc 8.8.8.8
tnc 8.8.8.8 -port 443
Test-NetConnection -ComputerName example.com -Port 80 -InformationLevel Detailed

# traceroute
tnc 8.8.8.8 -traceroute -hops 3

# poor man's port scan
$ports = "22","23","80","443","8080"
foreach ($port in $ports) {
  $t = new-object system.net.sockets.tcpclient -argumentlist "192.168.0.100",$port
  if ($t.connected) {
    write-host 'TCP port' $port
  }
  $u = new-object system.net.sockets.udpclient -argumentlist "192.168.0.100",$port
  if ($u.connected) {
    write-host 'UDP port' $port
  }
}

Port 2777                   # change SSH port from 22

PermitRootLogin no          # disable logging in as root
MaxAuthTries 1              # limit the authentication attempts for login session
LoginGraceTime 2            # limit the authentication time (in seconds)

# disable unused authentication methods
PasswordAuthentication no   # disable logging in with password instead of key
PermitEmptyPasswords no     # disable empty passwords
ChallengeResponseAuthentication no
KerberosAuthentication no
GSSAPIAuthentication no

X11Forwarding no          # disable remote graphical applications over SSH connection
PermitUserEnvironment no  # disallow clients to pass custom environment variables
  # NOTE: also remove any AcceptEnv options

# Allow SSH tunneling
AllowAgentForwarding yes
AllowTcpForwarding yes
PermitTunnel yes
GatewayPorts yes # bind remote port-forwards to server's localhost address
  # set to "clientspecified" to bind them to server's wildcard address

AllowUsers admin *@172.16.0.0/20
AllowGroups sshgroup

ClientAliveInterval 300   # send an alive message to the client at five minute interval
ClientAliveCountMax 2     # disconnect after 2 alive message

# trusted CA certificate for client signed keys
TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem

# validate sshd_config
sudo sshd -t

service ssh restart
systemctl reload sshd

ssh-copy-id -i id_rsa -p 22 -o PreferredAuthentications=passwords [email protected]
  # dry-run with -n

# connect to target through jumphost
ssh -J [email protected] [email protected]

# local port-forward localhost:12345 through forwarder to target.com:5000
ssh -L 12345:target.com:5000 -N [email protected]

# remote port-forward forwarder:12345 through localhost to target.com:5000
ssh -R 12345:target.com:5000 -N [email protected]
  # sshd_config GatewayPorts sets how server binds the remote port.
  # GatewayPorts yes : remote port is bound to server's localhost address.
  #   -R localhost:12345:target.com:5000
  # GatewayPorts clientspecified : remote port is bound to server's wildcard address.
  #   -R *:12345:target.com.5000

# start local SOCKS server for port-forwarding through bastion.com
ssh -D 127.0.0.1:1080 -N [email protected]

# start remote SOCKS server for connections forwarded from forwarder.com:1080
ssh -R 1080 -N [email protected]

# -J jumphost
Host target
  Hostname target.com
  User user
  ProxyJump [email protected]

# -L local port-forward
Host lforward
  Hostname forwarder.com
  User user
  LocalForward 12345 target.com:5000
  SessionType none # -N

# -R remote port-forward
Host rforward
  Hostname forwarder.com
  User user
  RemoteForward 12345 target.com:5000
  SessionType none # -N

# -D SOCKS server
Host socks-bastion
  Hostname bastion.com
  User user
  DynamicForward 1080
  SessionType none # -N

# -R SOCKS server
Host socks-rforward
  Hostname forwarder.com
  User user
  RemoteForward 1080
  SessionType none # -N
  # only permit listed targets
  PermitRemoteOpen allowed1:* allowed2:443

Host jumphost
  Hostname jumphost.com
  Port 22
  User user
  IdentityFile ~/.ssh/ed25519

Host target
  Hostname target.com
  User user
  ProxyJump jumphost

sudo dnf install fuse-sshfs
sudo apt install sshfs

mkdir /mnt/mountpoint

sshfs -o idmap=user user@example:/home/user/mountpoint /mnt/mountpoint
ls /mnt/mountpoint

# unmounting FUSE mount (use `umount` on OS X and FreeBSD for bind mounts)
fusermount3 -u /mnt/mountpoint/

# rhel & fedora
sudo cp mycert.pem /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

# ubuntu; store with extension .crt
sudo cp mycert.pem /usr/share/ca-certificates/mycert.crt
sudo update-ca-certificates

# add to a Java keystore
keytool -import -noprompt -keystore certs -file cert.pem -storepass 123 -alias service-cert

# add root CA to Java bundle
keytool -import -noprompt -cacerts -file cert.pem -storepass 123 -alias "service-cert"

# generate self-signed root CA certificate
openssl genrsa -aes256 -out rootcakey.pem 4096
openssl req -x509 -new -noenc -key rootcakey.pem -sha256 -subj "/CN=ROOTCA" -days 10000 -out rootca.pem
  # -noenc replaced -nodes since OpenSSL 3.0 (to not encrypt private keys)

# create CSR for host
openssl genrsa -out certkey.pem 2048
openssl req -new -sha256 \
  -key certkey.pem \
  -subj "/C=SE/O=My Org/CN=$(hostname)" \
  -reqexts SAN \
  -config <(cat /etc/pki/tls/openssl.cnf \
    <(echo -e "\n[SAN]\nsubjectAltName=DNS.1:*.$(hostname),DNS.2:localhost,IP:127.0.0.1")) \
  -out cert.csr

# create certificate issued by root CA
openssl x509 -req -sha256 -days 365 \
  -in cert.csr -out cert.pem \
  -CA rootca.pem -CAkey rootcakey.pem -CAcreateserial \
  -copy_extensions copy \
  -extfile <(echo 'extendedKeyUsage = serverAuth')

# view certificate
openssl x509 -text -noout -in cert.pem

TARGET='2026-06-01'
cal "${TARGET}"
START="$(date +%s)"
END="$(date +%s --date ${TARGET})"
DAYS="$(( 1 + (${END} - ${START}) / (3600*24) ))"

echo "There are ${DAYS} days between $(date --date @${START} +%F) and ${TARGET}"

curl --trace-ascii trace.txt http://example.com/
curl --trace-ascii trace.txt --trace-time -O http://example.com/
curl --head http://example.com/
curl --user user:password --upload-file file http://example.com/upload --next --user user:password http://example.com/results.html

# use personal access token
curl -u :${PAT} https://example.com   # (uses: Authorization: Basic Base64(':'+PAT))
curl -H 'Authorization: Bearer ${PAT}' https://example.com

# concatenates all --data and send application/x-www-form-urlencoded
curl http://example.com --data-urlencode "field1=value1" --data-urlencode "field2=value2"
curl http://example.com --form field1=@localfilename --form field2=value2

# use request headers and payload from files
curl \
  -H @headers.txt \
  --data @payload.json \
  https://example.com

# dump response headers and payload to files
curl --dump-header /tmp/headers.txt --remote-name --output-dir /tmp --no-clobber https://example.com

curl --config - <<EOF
# --- fetch from two URLs ---
url = "https://example.com"
remote-name-all
output-dir example
create-dirs
no-clobber
user-agent = "superagent/1.0"
next
url = "example.com/docs/manpage.html"
referer = "http://nowhereatall.example.com/"
EOF

traceroute www.apple.com # UDP
sudo traceroute -I www.apple.com # ICMP

traceroute to www.apple.com (23.46.180.139), 30 hops max, 60 byte packets
1 192.168.1.1 (192.168.1.1) 0.225 ms 0.273 ms 0.283 ms
2 10.10.0.1 (10.10.0.1) 11.046 ms 11.938 ms 16.645 ms
3 pool.hargray.net (64.202.123.123) 28.169 ms 22.060 ms 21.785 ms
4 10ge14-8.core1.atl1.he.net (216.66.49.77) 22.552 ms 22.391 ms 19.566 ms
5 atx-brdr-01.inet.qwest.net (63.146.26.69) 23.189 ms 21.705 ms 21.952 ms
6 a23-46-180-139.deploy.static.akamaitechnologies.com (23.46.180.139) 21.116 ms 21.365 ms 19.497 ms

# Connect to port 80:
nc www.google.com 80

# report connection status
nc -z --verbose 10.10.8.8 22

# Listen on TCP port 1234
nc -v -k -l 1234, UDP port: nc -v -k -ul 1234
# Allow/deny: --allow 192.168.0.0/24, --deny 10.0.0.0/8

# Transfer file:
cat file.txt | nc -v -l -p 5555 # sender
nc host 5555 > file_copy.txt # receiver

# Remote shell:
nc --verbose --listen --exec /bin/bash 31337 --max-conns 3 --allow 192.168.0.0/24 # server
nc host, telnet host 31337 # client

# Reverse telnet:
nc -vv -l # Computer with public IP
nc -v public_host -e /bin/bash # Computer behind firewall

# run a server
nc -l -p 8080
# run client that sends to server
echo 'hello' | nc 10.128.54.212 8080

# port scanning; -z to not send any data
nc -z -v 10.10.8.8 20-80
# 
echo "EXIT" | nc 10.10.8.8 22

# Create an HTTP proxy server on localhost port 8888
nc --listen --proxy-type http localhost 8888

# scan for open ports (most common ports 22, 80, 442, 8080 et cetera)
nmap -F 192.168.0.20

# Check provided SSLv3/TLS ciphers
nmap -sV --script ssl-enum-ciphers -p 443 example.com

sudo -E capsh --caps="cap_setpcap,cap_setuid,cap_setgid+ep cap_net_raw+eip" --keep=1 --user="$USER" --addamb="cap_net_raw" -- -c /usr/sbin/tcpdump -i eth0 -A -n port 80

# sniff net but ignore IP which is your remote session
tcpdump -n host not XXX.XXX.XXX.XXX | less

# network sniffer on a physical device
tcpdump -nnei enp1s0 -vvv

# show traffic on bridge interface
tcpdump -qnni br0

# dump socket statistics
ss --tcp --udp --listening --all --processes --numeric # -tulpn
# check open ports
ss --threads --all --numeric

systemctl status NetworkManager.service
journalctl --follow --unit NetworkManager.service

nmcli general status
nmcli device status
nmcli connection show
nmcli radio wifi # WiFi status
nmcli general logging # list log lovel and domains
nmcli general log level DEBUG domains CORE,ETHER,IP # log debug for domains
nmcli general log level INFO domains DEFAULT # restore default logging level

man 8 NetworkManager
man 7 nmcli-examples
man 5 nm-settings-nmcli # description of settings
man 5 NetworkManager.conf

# show all relevant fields
nmcli connection show myconn
# print specific fields
nmcli --fields ip4.address,ip4.dns,ip4.gateway connection show myconn
nmcli --fields DHCP4.OPTION connection show myconn
nmcli --get-values ip4.address,ip4.dns,ip4.gateway connection show myconn
nmcli -p -f general,wifi-properties device show wlan0

# connect to WiFi access point
nmcli radio wifi on
nmcli device wifi list # show access points (SSIDs)
nmcli device wifi connect "${SSID}" password "${PASSWORD}"
nmcli --ask device wifi connect "${SSID}" # prompts for password
# show wifi password
nmcli --show-secrets --fields 802-11-wireless-security.psk connection show 'My WiFi connection'
nmcli device wifi show-password

# edit connection settings with interactive prompt
nmcli connection edit myconn
nmcli> print
nmcli> describe autoconnect
nmcli> set ipv4.method auto
nmcli> verify
nmcli> set ipv4.method manual
nmcli> set ipv4.ip 192.168.1.123/24
nmcli> set ipv4.gateway 192.168.1.1
nmcli> set ipv4.dns 8.8.8.8 8.8.4.4
nmcli> goto connection
nmcli> print
nmcli> save
nmcli> quit

man 5 NetworkManager.conf
sudo vi /etc/NetworkManager/NetworkManager.conf
cat /etc/NetworkManager/conf.d/*
nmcli general reload conf

# override DNS servers provided by DHCP (max. 3 servers)
nmcli connection modify myconn ipv4.method auto # auto for DHCP, else manual
nmcli connection modify myconn ipv4.dns '8.8.8.8 8.8.4.4' ipv4.ignore-auto-dns true
nmcli connection down myconn
nmcli connection up myconn
cat /etc/resolv.conf

# configure a static route for 192.168.122.0/24 subnet to gateway 10.10.10.1 through enp1s0
nmcli connection modify enp1s0 +ipv4.routes "192.168.122.0/24 10.10.10.1"

# set firewalld zone for connection's interface
nmcli connection modify myconn connection.zone ZONE_NAME
nmcli connection modify myconn connection.zone '' # unset to add to default zone
# or, edit INI file settings and reload
sudo vi /etc/NetworkManager/system-connections/myconn.nmconnection # [connection]\nzone=trusted
nmcli connection reload

alias ip='ip -c=auto'
ip -brief link show
ip -brief address show
ip -details addr # -d,--details
ip link show dev
ip link show type bridge
ip -d link ls

# view documentation of network device status flags
man 7 netdevice
  # UP          : Interface is running
  # BROADCAST   : Valid broadcast address set
  # DEBUG       : Internal debugging flag
  # LOOPBACK    : Interface is a loopback interface
  # POINTOPOINT : Interface is a point-to-point link
  # RUNNING     : Resources allocated
  # NOARP       : No arp protocol, L2 destination address not set
  # PROMISC     : Interface is in promiscuous mode
  # NOTRAILERS  : Avoid use of trailers
  # ALLMULTI    : Receive all multicast packets
  # MASTER      : Master of a load balancing bundle
  # SLAVE       : Slave of a load balancing bundle
  # MULTICAST   : Supports multicas
  # PORTSEL     : Is able to select media type via ifmap
  # AUTOMEDIA   : Auto media selection active
  # DYNAMIC     : The addresses are lost when the interface goes down
  # LOWER_UP    : Driver signals L1 up (connected to a switch)
  # DORMANT     : Driver signals dormant
  # ECHO        : Echo sent packets
  # NO-CARRIER  : No link level connection

ip route show # show Linux kernel routing table
  # Example:
  #   default via 192.168.0.1 dev enp6s0 proto dhcp src 192.168.0.145 metric 100
  #   192.168.1.0/24 dev enp6s0 proto kernel scope link src 192.168.0.145
  # Means:
  #   the default route is via interface enp6s0.
  #   packets from 192.168.0.145 to network 192.168.1.0/24 are sent through the device enp6s0.
ip route get 192.168.1.5 # display the route taken for IP 192.168.1.5
ip address show to 192.168.0.0/24
ip neigh show # shows the MAC addresses of devices
  # REACHABLE signifies a valid, reachable entry until the timeout expires
  # PERMANENT signifies an everlasting entry that only an administrator can remove
  # STALE signifies a valid, yet unreachable entry; to check its state, the kernel checks it at the first transmission
  # DELAY signifies that the kernel is still waiting for validation from the stale entry
ip -stats neigh flush 192.168.10.5 # flush ARP entry

# flush IP addresses on eth4
ip -statistics -statistics address flush dev eth4 scope global

# enter network namespace
ip netns exec ns0 bash

ip link set enp6s0 up # ip link set dev em1 up
ip link set enp6s0 down # ip link set dev em1 down
ip link set enp6s0 mtu 9000
ip link set enp6s0 promisc on # enable promiscous mode to accept packets for other MAC addresses
ip link set br0 address 56:84:7a:fe:97:99 # change MAC address

# manually add default route for all addresses via the gateway 192.168.0.1 on device br0
ip route del default
ip route add default via 192.168.0.1 dev br0 # set router IP address as gateway through br0

# configure a static route for 192.168.122.0/24 subnet to gateway 10.10.10.1 through enp1s0
ip route del 192.168.122.0/24
ip route add 192.168.122.0/24 via 10.0.0.1 dev enp1s0

# add multiple IP addresses on interface (first is primary address)
ip address add 192.168.2.223/24 dev enp1s0
ip address add 192.168.4.223/24 dev enp1s0
# remove IP addresses
ip address delete 192.168.4.223/24 dev enp1s0
ip address flush dev enp1s0 # removes all IP addresses

# configure privileged ports temporarily
sudo sysctl -w net.ipv4.ip_unprivileged_port_start=80
# permanently
echo 'net.ipv4.ip_unprivileged_port_start=80' | sudo tee --append /etc/sysctl.conf
sysctl -p
# or in subfolder
echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/90-ipforward.conf
sysctl -p /etc/sysctl.d/90-ipforward.conf

# check status of bridge Linux module (and related modules)
lsmod | grep bridge
  # they are automatically inserted when creating a bridge
rmmod bridge # remove bridge module

ip link show master br0     # display port configuration for bridge
bridge link show            # display port configuration for all bridges
bridge fdb show -statistics # display known Ethernet addresses on a link (forwarding table)
bridge vlan show -details   # display VLAN filter table
bridge monitor all          # display link, fdb, vlan, mdb state changes continuously

# create two veth pairs
ip link add veth00 type veth peer name veth01 # create veth00-veth01
ip link add veth10 type veth peer name veth11 # create veth10-veth11

# create bridge
ip link add br0 type bridge

# add one of the pairs to bridge
ip link set dev veth00 master br0
ip link set dev veth10 master br0

# create network namespaces
ip netns add ns0
ip netns add ns1
# add one of the pairs to namespace
ip link set veth01 netns ns0
ip link set veth11 netns ns1

# bring them up
ip link set br0 up
ip link set veth00 up
ip link set veth10 up
ip netns exec ns0 ip link set veth01 up
ip netns exec ns1 ip link set veth11 up

# set static IP adresses in the namespaces
ip netns exec ns0 ip addr add dev veth01 192.168.56.1/24
ip netns exec ns1 ip addr add dev veth11 192.168.56.2/24

# ping from namespace
ip netns exec ns0 ip link show
ip netns exec ns0 ip route show
ip netns exec ns0 ping -c 1 192.168.56.2

# set STP
ip link set br0 type bridge stp_state 1
s
# remove interface from bridge
ip link set dev veth00 nomaster

# create connection for bridge interface "br0"
nmcli connection add \
  connection.id 'bridge-br0' \
  type bridge \
  connection.interface-name br0 \
  connection.autoconnect yes \
  connection.autoconnect-slaves 1 \
  ipv4.method auto ipv6.method auto

# create an ethernet bridge slave connection for interface "enp1s0"
nmcli connection add \
  connection.id 'ethernet-enp1s0' \
  type ethernet \
  connection.interface-name enp1s0 \
  connection.autoconnect yes \
  connection.master br0 \
  connection.slave-type bridge
# or, change existing connection
nmcli connection modify ethernet-enp1s0 master bridge-br0 slave-type bridge

nmcli connection up id ethernet-enp1s0
nmcli connection up id bridge-br0

nmcli connection monitor id bridge-br0 # prints a line whenever the specified connection changes
nmcli device show # bridge should have an IP4 address and gateway and DNS

# add VLAN connection with static IP address
nmcli connection add type vlan con-name vlan10-enp1s0 \
  ifname vlan10 \
  vlan.parent enp1s0 \
  vlan.id 10 \
  ipv4.addresses '192.168.10.1/24' \
  ipv4.gateway '192.168.10.254' \
  ipv4.dns '192.168.10.253' \
  ipv4.method manual

# check if firewall dropped
dmesg | grep DROPPED
grep DROPPED /var/log/kern.log

# drop all incoming ICMP (ping) packets
echo 1 | sudo tee /proc/sys/net/ipv4/icmp_echo_ignore_all

podman network create test-net
podman network ls
podman network inspect test-net

podman container run -d --name mycontainer \
  -p 8080:80 -p 10000:10000/udp --net test-net --ip=10.89.0.5 myimage:tag
podman container inspect mycontainer | grep IPAddress
podman port mycontainer

podman network rm test-net
podman network prune # remove all unused networks

podman network create --subnet 10.99.0.0/30 small-net
  # network address: 10.99.0.0
  # broadcast address: 10.99.0.3
  # available addresses: 10.99.0.1 - 10.99.0.2
  # gateway: 10.99.0.1

# enter network namespace for non-root containers
podman unshare --rootless-cni ip address show

<owner> <class> <ttl> TXT "<attribute name>=<attribute value>"
host.widgets.com   IN   TXT   "printer=lpr5"
sam.widgets.com    IN   TXT   "favorite drink=orange juice"