Tools every sysadmin and network admin should have

[hydn (Hayden James)]

Every sysadmin and network admin ends up with a core set of tools they reach for without thinking.

Here’s my shortlist, not installed by default, so I grap what I need. Most of these are already in Debian’s repos, so nothing exotic. If you work with web apps some of these are useful. So list is not just limited to network and system security.

Side note, the Kali tools page is a decent directory to peruse regardless of the distro you are on.

Tool	Primary Use	Why It’s Essential
nmap	Network discovery and security auditing	Industry-standard for scanning hosts, open ports, services, and OS detection.
Wireshark	Packet analysis and network troubleshooting	Deep inspection of network traffic to diagnose issues, verify configurations, and detect anomalies.
tcpdump	Command-line packet capture	Lightweight alternative to Wireshark for quick captures on servers or remote systems.
tcpflow / netsniff-ng	Network traffic reconstruction	Useful for analyzing session data and debugging application-layer issues.
fping / hping3	Host reachability and latency testing	Faster and more flexible than ping for testing multiple hosts or crafting custom probes.
arping / arpwatch	ARP-level discovery and monitoring	Verifies host presence at Layer 2 and detects ARP spoofing or conflicts.
snmp-check / onesixtyone	SNMP enumeration	Quick checks of SNMP-enabled devices for inventory and misconfigurations.
sslscan / sslyze	SSL/TLS configuration auditing	Verifies certificate validity, protocol support, and cipher strength on servers.
metasploit-framework	Vulnerability validation and patch testing	Advanced use: confirms whether known vulnerabilities are exploitable before/after patching.
searchsploit / exploitdb-papers	Vulnerability research	Quickly find public exploits and advisories related to versions you’re running.
chisel / socat / ncat / netcat	Tunneling and ad-hoc connections	Handy for port forwarding, quick listeners, and troubleshooting connectivity.
gvm-start (Greenbone Vulnerability Management)	Vulnerability scanning	Full-featured vulnerability scanner for regular security audits.
autopsy / tsk_* tools (Sleuth Kit)	Basic forensics and file recovery	Helpful for incident response or recovering deleted files on Linux/Windows filesystems.
yara	Malware and IOC scanning	Create or run rules to detect suspicious files during incident response.

Also see:

90+ Linux Commands frequently used by Linux Sysadmins | LinuxBlog.io

60 Linux Networking commands and scripts | LinuxBlog.io

Tools, cheat sheets and other useful resources

This is a Wiki post; a wiki post is a special type of post that any member of our community can edit! Also see: The Linux Resources Mega Thread Join me in editing and populating this Wiki post by sharing tools, scripts, cheat sheets, etc., that you frequently refer to or have saved to your bookmarks. Config Provisioning & Management Ansible – open-source software provisioning, config management, and app-deployment tool. Chef Infra – infrastructure automation framework that turns infrastructu…

[andreas]

Thank you, as someone relatively unfamiliar with network tools and recently found the need to dabble in that area a bit more often, this is very useful

[ugnvs (Eugene)]

I’d add to the list old-school ping, traceroute and tracepath. The latter adds max packet size discovery along route.

[hydn (Hayden James)]

Well, yes, however, the list is for “sysadmins and network admins” generally should already be using ping, etc.

But they are included in the more extended 90+ commands link listed above. They are still backbone, go to commands we learn early and keep using. Thanks.

[Brian_Masinick]

@ugnvs

I’d add to the list old-school ping, traceroute and tracepath. The latter adds max packet size discovery along route.

Yeah, those are classic tools.
The “more modern list” of tools that @hydn cites is fine. For me, my systems are minimal and tools like those you mention are among the standard ones I have available too.

When I run into an issue or I need to fine tune something, I see if what I need is available; if not, I search and decide which tool or tools are needed to have available in addition to what I have present.

I’m going to look at a few that @hydn mentions and possibly add them to one of my “fuller” distributions installed: EndeavourOS, Slackware or MX Linux. EndeavourOS may be a good place to start; Slackware has a decent set of tools, but not always the latest and greatest; they can be added in, but it may be easier to put them in place if EndeavourOS has existing packages available.

So far I added fping and searchsploit to the tools on EndeavourOS. I’m about to add gvm-start; it’s not included in the repos so I’ll see if there is a convenient way to install it. It does install as gvm. Apparently gvm-start is a command once gvm is installed.

I tried installing autopsy; still need some more packages to configure it, so I’ll keep incrementally adding a few packages on this system.

[Furqan_Ashraf]

Nice thread. One I’d add to the mix: for domain and IP investigation work (bulk WHOIS lookups, DNS records, IP geolocation), the built-in whois command gets slow for anything at scale, so I ended up scripting a few small Bash CLI wrappers around WhoisFreaks for this. Put the CLI tools up here if anyone wants to poke around: GitHub - Furqan-Ashraf/apifreaks-cli-tools · GitHub

Also agree with the ping/traceroute/tracepath basics, still the first thing I reach for before anything fancier.