Network Tools: ping, dig, traceroute

Diagnose connectivity from the shell

When something "isn't loading," four small tools tell you where the break is: ping, dig, traceroute, nc (netcat). Each answers a different layer.

ping — can I reach this host?

ping -c 4 example.com

Sends ICMP Echo packets. -c 4 stops after 4. If you get responses, the IP layer works. If "unknown host," DNS broke. If "timeout," a firewall blocks ICMP or the host is down.

dig — what does DNS resolve to?

dig example.com
dig example.com A           # IPv4 only
dig example.com AAAA        # IPv6 only
dig example.com MX          # mail servers
dig +short example.com      # just the answer
dig @8.8.8.8 example.com    # ask Google DNS specifically

dig +short is your scripting friend. To debug propagation, ask multiple resolvers (@8.8.8.8, @1.1.1.1) and compare answers.

traceroute — where does the packet die?

traceroute example.com
traceroute -P icmp example.com  # ICMP probes (sometimes pass when UDP doesn't)

Each line is a router on the path. Stars (* * *) at every hop after some point usually means a firewall is silently dropping probes rather than the path being broken. mtr (brew install mtr) is a continuously-updating traceroute — great for spotting flaky links.

nc — raw TCP/UDP probe

nc -zv example.com 443    # is port 443 open?
nc -zv localhost 5432     # is local Postgres listening?

-z = scan, no data. -v = verbose. The fastest way to ask "can I open a TCP connection to that port?" without using a client.

The triage flow

1. ping host — IP works?
2. dig +short host — DNS works?
3. nc -zv host port — port open?
4. curl -v https://... — TLS / HTTP works?

Walk those four in order and the layer that fails tells you where the fix lives.