Lesson 6 of 725 minutesHands-on

Your network from the terminal

Everything you’ve looked at through our web tools can be seen from the command line too, and on a server without a screen it’s the only way. In this lesson you’ll find your addresses and your router, read a website’s raw replies, then run a tiny web server of your own and watch its port open and close. If the words IP address and DNS are new to you, start with How the Internet Works.

In this lesson

Find your addresses and your router from the terminal
Read a website’s replies with curl
See which ports are listening, and what 127.0.0.1 and 0.0.0.0 really mean

You’ll need: the terminal and an internet connection. For part 3 you’ll have two terminal windows open at once.

Try it yourself · part 1

Find your addresses

🐧 Linux and 🪟 WSL

List your network connections and their addresses. -br means brief:

ip -br addr

lo               UNKNOWN        127.0.0.1/8 ::1/128
eth0             UP             192.168.1.42/24

lo is the “loopback”, the computer talking to itself. The other one is your real connection, and its name varies (eth0, wlan0, enp3s0). The /24 is the block size from Read an Address Block.

Now find your router. It’s the “default” route, the way out for anything not on your own network:

ip route

default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 scope link src 192.168.1.42

In WSL, you’ll probably see something different. Linux normally runs in its own small virtual network inside Windows, often with an address starting 172, and that “router” is really Windows. To see your Windows address from here, run ipconfig.exe.

🍎 Mac

Macs don’t have the ip command. Get your Wi-Fi address and your router with these. If the first prints nothing, your connection may be en1 instead:

ipconfig getifaddr en0

netstat -rn | grep default

Those are your private addresses, which only mean something inside your home. To see your public address, ask a server on the internet where your request came from. This one is a small public service, and -4 asks for IPv4:

curl -4 https://icanhazip.com

Compare it with our What Is My IP page. They should match, unless you’re using a VPN in one and not the other.

curl: talk to a website directly

curl makes web requests without a browser. It’s like seeing the conversation your browser hides. Add -I to ask only for the headers, the short note a server sends ahead of the page.

Try it yourself · part 2

Read a server’s reply

Ask for just the first three lines of the reply, using the pipe from Lesson 4:
curl -sI https://examineip.com | head -n 3
```
HTTP/2 200
date: Sun, 01 Nov 2026 07:26:45 GMT
content-type: text/html; charset=UTF-8
```
-s means silent, without a progress meter. 200 means “OK, here’s the page”.
Now ask for the old, unencrypted address and see what happens:
curl -sI http://examineip.com | grep -i -E '^(http|location)'
```
HTTP/1.1 301 Moved Permanently
Location: https://examineip.com/
```
The server replied “this has moved” and gave the secure address. A browser follows that automatically, which is why you rarely notice it.
Look up an address the way your computer does:
getent hosts examineip.com
It’s one line per address, and you may see long IPv6 addresses. On a Mac use dig +short examineip.com. On Ubuntu, dig comes from sudo apt install bind9-dnsutils.

Code	Meaning
200	OK
301, 302	Moved: look in the `location` line
403	Forbidden: it’s there, but you aren’t allowed
404	Not found
500, 503	The server has a problem, or is too busy

Our Security Headers checker reads these same headers and explains what they mean for a site’s security, and the DNS Checker shows what’s behind a name.

Ports: what’s listening?

A program that waits for connections is said to be listening on a port. To see this properly, you’ll start a tiny web server of your own, using the Python language that’s included with Ubuntu. On a Mac, running python3 for the first time may offer to install Apple’s developer tools; accept that or skip part 3.

Try it yourself · part 3

Run a web server and watch its port

Make a folder with a page in it, then start the server. It will sit there without returning to the prompt. That’s normal, because it’s now waiting for visitors.
mkdir -p ~/site
cd ~/site
echo "Hello from my own server" > index.html
python3 -m http.server 8000 --bind 127.0.0.1
Open a second terminal window. See what’s listening. -t means TCP, -l means listening and -n means show numbers:
ss -tln
```
State   Recv-Q  Send-Q  Local Address:Port   Peer Address:Port
LISTEN  0       5           127.0.0.1:8000        0.0.0.0:*
```
You’ll probably see some others too. On a Mac, use lsof -nP -iTCP -sTCP:LISTEN instead.
Be your own first visitor, in the second window:
curl http://127.0.0.1:8000
```
Hello from my own server
```
Glance at the first window: your server logged the request, in the same style as the log from Lesson 4.
In the first window, press Ctrl + C to stop the server. In the second, try again:
curl http://127.0.0.1:8000
```
curl: (7) Failed to connect to 127.0.0.1 port 8000 after 0 ms: Could not connect to server
```
The port is closed because nothing is listening any more. That’s what “closed” means.

The address it’s listening on matters

Local address	Who can connect
127.0.0.1	Only programs on this same computer
192.168.1.42 (or similar)	Others on your network who can reach that address
0.0.0.0	Any network this computer is connected to

You used --bind 127.0.0.1 on purpose, so that nobody else could reach your test server. Without it, that server listens on 0.0.0.0 and any device on your network can read the folder it serves. When you’re checking a machine, a service on 127.0.0.1 is usually nothing to worry about, while one on 0.0.0.0 deserves the question “do I mean this to be reachable?”

The internet is a separate question. ss shows what’s listening on this computer, while your router decides what gets in from outside. To test that side, use the Port Scanner, as in What’s Open to the Internet?

What about SSH? Once you have a server or a Raspberry Pi, ssh user@address gives you a terminal on it over an encrypted connection, and all the commands in this course then work on that machine. SSH listens on port 22.

Key takeaways

ip -br addr shows your addresses and ip route shows your router (Macs have different commands).
curl -I shows a server’s headers, including its status code.
A port is open only while a program is listening on it.
127.0.0.1 is reachable only from this computer. 0.0.0.0 means every network it’s on.
ss shows what’s listening here. The Port Scanner shows what the internet can reach.

Check yourself

Three questions. Pick one answer each and you’ll see why.

1. curl -I shows HTTP/1.1 301 and a location line. What does it mean?

Codes in the 300s are redirects. Browsers follow them automatically, and curl shows you the step that browsers hide.

2. ss -tln shows a program listening on 127.0.0.1:8000. Who can connect to it?

3. ss shows a service listening on 0.0.0.0:22. Is it open to the whole internet?

One lesson left: you’ll put these commands together into scripts that do the boring work for you.

This lesson is part of the free course Linux and the Command Line, licensed under CC BY-NC-SA 4.0: you may share and adapt it for non-commercial use, with credit to ExamineIP and a link to the original.