<aside> 📡

L5.1 — Network Tools by Kirk Martinez. This lecture provides a practical overview of essential network tools used for diagnosing, monitoring, and debugging network activity across different layers of the TCP/IP stack. It covers layer encapsulation recap, packet capture tools (tcpdump and Wireshark), network sniffing and security implications, DNS lookup tools (nslookup, dig, whois), network configuration tools (netstat and the ip command), port scanning with nmap, monitoring and benchmarking tools (iftop, nethogs, iperf3), and network simulators for design and testing.

</aside>

📋 At a Glance

• [ ] Understand layer encapsulation and how headers are added at each layer (Application → Transport → Network → Link)
• [ ] Know the basics of tcpdump: interface selection (-i), verbosity (-v), file capture (-w), and filter patterns (host, port, src, dst)
• [ ] Understand network sniffing concepts — what traffic you can see depends on where you run the tool
• [ ] Know Wireshark's three-pane layout: packet list, protocol layers, and hex dump
• [ ] Understand how to use display filters in Wireshark to limit visible traffic
• [ ] Know that tcpdump and Wireshark use the same file format — captures are interchangeable
• [ ] Use nslookup to resolve domain names and identify CNAME records and CDN usage
• [ ] Use dig for detailed DNS queries — question section, answer section, query time
• [ ] Understand whois for looking up domain registration information (registrar, expiry, name servers)
• [ ] Know that multiple A records allow load balancing across servers
• [ ] Know netstat options: -i (interfaces), -n (connections), -s (stats), -r (routing table)
• [ ] Master the ip command: ip -br a (interfaces), ip link show (MAC/MTU), ip route (routing table)
• [ ] Understand that the ip command is the modern replacement for ifconfig
• [ ] Know what nmap does — scans for open ports and running services on a host
• [ ] Understand nmap best practices: only scan your own machines, use common-port options, respect network policies
• [ ] Know iftop for real-time bandwidth monitoring per connection
• [ ] Know nethogs for identifying which processes are using the most bandwidth