Network troubleshooting for beginners: Part 4 — mtr, nmap and curl

Simple utilities from previous parts each answer their own question: ping — is there connectivity, traceroute — which path packets take, nc — is the port open. The three tools in this part give a more complete picture: mtr watches the route continuously, nmap checks many ports at once, and curl shows what the web server actually responds.

mtr: route and losses in real time

mtr combines ping and traceroute: it continuously sends packets to every hop along the path and measures latency and loss. This helps find intermittent problems that are not visible with a single traceroute.

Installation:

sudo apt install mtr-tiny     # Debian and Ubuntu, console version
brew install mtr              # macOS

Interactive mode:

mtr google.com

Report for sharing or saving — 100 cycles and a final table:

mtr -rwc 100 google.com

• -r — report mode;
• -w — full host names without truncation;
• -c 100 — number of cycles.

Example report:

HOST                        Loss%   Snt   Last   Avg  Best  Wrst StDev
1. _gateway                  0.0%   100    0.4   0.4   0.3   0.6   0.0
2. 10.0.0.1                  0.0%   100    1.2   1.5   1.1   5.2   0.5
3. core-router.example.net  10.0%   100   15.1  14.8  14.5  16.0   0.4
4. 142.250.184.110           0.0%   100   16.0  16.2  15.8  17.1   0.3

How to read:

• loss only on a single intermediate hop, while following hops and the destination show 0% — this is not a problem: the router limits responses to probe packets, while transit traffic passes;
• loss that starts at some hop and persists to the end of the route indicates a problematic segment;
• large latency variance (StDev, Wrst) is a sign of link congestion.

By default mtr sends ICMP. If ICMP is limited along the path, try TCP to the desired port: mtr -T -P 443 example.com.

nmap: which ports are open

nmap checks a host’s ports and shows their state. Scan only your hosts or those you have permission for; for experiments the nmap project provides the host scanme.nmap.org.

nmap scanme.nmap.org

By default the 1000 most common TCP ports are scanned. Example result:

PORT      STATE    SERVICE
22/tcp    open     ssh
80/tcp    open     http
443/tcp   filtered https

• open — the service accepts connections;
• closed — the host replied that the port is closed;
• filtered — no response, packets are dropped by a firewall.

Useful options:

nmap -p 22,80,443 example.com     # only the specified ports
nmap -sV -p 443 example.com       # determine the service and its version
nmap -sn 192.168.1.0/24           # find active hosts in your network without scanning ports

curl: what the web server responds

curl sends an HTTP request and shows the server’s response without browser processing.

Response headers only:

curl -I https://google.com

HTTP/2 301
location: https://www.google.com/

Status 301 means a permanent redirect, the location header is the address to which it redirects. To make curl follow redirects, add -L.

Detailed connection progress:

curl -v https://example.com

The output shows which address is being connected to, how the TLS handshake proceeds, and which headers were sent and received. This helps distinguish a certificate error from an application error.

Time of each stage:

curl -o /dev/null -s -w 'DNS: %{time_namelookup}s  TCP: %{time_connect}s  TLS: %{time_appconnect}s  total: %{time_total}s\n' https://example.com

Checking the site at a specific address bypassing DNS — for example, a new server before switching the record:

curl -I --resolve example.com:443:203.0.113.10 https://example.com

The main curl flags are covered in the article “curl for beginners”.

Summary

• mtr — intermittent route problems and the segment where losses begin;
• nmap — status of many ports at once: open, closed, filtered;
• curl — exactly what the web server responds with, how long each stage takes, and whether the certificate works.

If even these tools don’t show the cause, you have to look at the packets themselves — that’s what the last part is about.

Resources

• mtr (GitHub)
• Nmap reference
• curl documentation