Net-Tools

Net-Tools is a legacy collection of Linux networking utilities (such as ifconfig, route, netstat, arp, and nameif) used to inspect and configure network interfaces, routing, sockets, and neighbor/ARP tables. Many of these tools are deprecated in favor of the iproute2 suite (ip, ss, bridge, tc), but Net-Tools is still encountered on older systems, in older runbooks, and in scripts that have not yet been updated.

Background and history

Net-Tools originated in early Linux networking administration when ifconfig and netstat were the common interfaces for managing network state. As Linux networking grew more complex (namespaces, advanced routing, policy routing, modern link types), iproute2 became the preferred interface because it exposes newer kernel capabilities more consistently.

Net-Tools remains common in operational environments that maintain older Linux images, tutorials, and automation written before iproute2 became the standard.

Maintained by

• Maintained by the Linux distribution community as a legacy package.

Best When to Use

• You are working on an older distribution where Net-Tools is installed and operational procedures depend on it.
• You must interpret legacy runbooks or scripts that reference ifconfig, route, or netstat.
• You need a quick read-only check on a system where iproute2 tooling is missing.

Not Suitable When

• You need modern networking features (namespaces, policy routing, VRFs, advanced link types).
• You are writing new automation or documentation intended to be portable across modern distributions.
• You need consistent, future-proof output for scripting and monitoring.

Compatibility Notes

• Net-Tools is often not installed by default on modern distributions.

• Output formats vary across versions and distributions, which makes parsing unreliable.

• For new systems, prefer iproute2:

  • ip replaces ifconfig and route
  • ss replaces most netstat socket use cases

• Some Net-Tools behaviors are incomplete or misleading compared to modern kernel state.

Operational safety

Avoid using Net-Tools for persistent configuration changes. Prefer distro-native networking configuration (NetworkManager, systemd-networkd, ifupdown) or iproute2 for runtime changes.

Installation

Debian/Ubuntu

sudo apt update
sudo apt install net-tools

RHEL/CentOS Stream/Fedora

sudo dnf install net-tools

Alpine

sudo apk add net-tools

Arch Linux

sudo pacman -S net-tools

How It Works

Net-Tools utilities read and write network state through kernel interfaces (historically /proc and ioctl-based APIs). Modern tooling (iproute2) primarily uses Netlink, which exposes newer kernel networking features more completely and consistently.

Common Commands and Safer Modern Equivalents

Interface and address inspection

Task	Net-Tools	Modern equivalent
-	-	--
Show interfaces and IPs	ifconfig -a	ip addr show
Show interface link state	ifconfig eth0	ip link show dev eth0
Show only IPv4 addresses	ifconfig (varies)	ip -4 addr
Show only IPv6 addresses	ifconfig (varies)	ip -6 addr

Examples:

# Legacy
ifconfig -a

# Modern
ip addr show

Routing table

Task	Net-Tools	Modern equivalent
	-		--
Show routes	route -n	ip route show
Show IPv6 routes	route -A inet6 (varies)	ip -6 route show
Show default route	`route -n	grep '^0.0.0.0'`	ip route show default

Examples:

# Legacy
route -n

# Modern
ip route show

Sockets and listening ports

Task	Net-Tools	Modern equivalent
	--	--
List listening TCP/UDP	netstat -tulpen	ss -tulpen
Show all TCP connections	netstat -tan	ss -tan
Show per-process sockets	netstat -p	ss -p

Examples:

# Legacy
netstat -tulpen

# Modern
ss -tulpen

Correction

For socket inspection, ss is the preferred replacement for most netstat usage. It is faster and reflects modern kernel networking state more accurately.

ARP / neighbor table

Task	Net-Tools	Modern equivalent
-	-	-
Show ARP cache	arp -n	ip neigh show
Delete an ARP entry	arp -d <ip>	ip neigh del <ip> dev <iface>

Examples:

# Legacy
arp -n

# Modern
ip neigh show

Practical Use Cases

Confirm IP configuration and default gateway

Safe read-only checks:

ifconfig -a
route -n
netstat -rn

Modern equivalent:

ip addr show
ip route show

Identify what is listening on a port

# Legacy
netstat -tulpen | grep -E ':(22|80|443)\s'

# Modern
ss -tulpen | grep -E ':(22|80|443)\s'

Verify ARP/neighbor resolution on a LAN

# Legacy
arp -n

# Modern
ip neigh show

Troubleshooting

Symptom	Likely Cause	Safe Checks	Fix
--	-	--
ifconfig: command not found	Net-Tools not installed	command -v ifconfig	Install net-tools or use ip addr
netstat output differs from expected	Legacy/partial visibility	Compare with ss -tulpen	Prefer ss for sockets
Routes look missing or incomplete	Tool limitations or policy routing	ip route show, ip rule show	Use iproute2 for full view
Interface shows up but traffic fails	Link/DNS/firewall issues	ip link, ip addr, ss, ping, resolvectl status (systemd)	Diagnose with modern tools and logs

Security Notes

• Treat port and socket output as sensitive: it can reveal running services and internal topology.
• Avoid sharing raw netstat -p output externally because it may expose process names and service details.
• Prefer least-privilege inspection. Some flags require elevated privileges to show process ownership.

Quick Reference Cheat Sheet

Goal	Net-Tools	Modern equivalent
-	--	--
Interfaces + IPs	ifconfig -a	ip addr
Routes	route -n	ip route
Listening ports	netstat -tulpen	ss -tulpen
Connections	netstat -tan	ss -tan
ARP/Neighbors	arp -n	ip neigh
Interface stats	netstat -i	ip -s link

Key Files and Locations

Path	Purpose
	-
/proc/net/	Kernel networking information (legacy access path used by older tools)
/etc/networks	Legacy network name definitions (rarely used today)
/etc/hosts	Local hostname/IP mapping (still commonly used)
/etc/resolv.conf	DNS resolver configuration (often managed by a resolver service)