When the latency graph spikes or DNS goes sideways, you do not want to learn a new tool — you want the right one already on your $PATH. These are the modern replacements for dig, traceroute, ping, plus a handful of niche TUIs worth knowing. ★ marks the picks.
Continuous traceroute that pings every hop and shows packet loss and latency at each. When a transit network is dropping packets two hops upstream of you, this is how you find out.
traviscross/mtr→A modern DNS client — colourised output, JSON mode, DNS-over-HTTPS and DNS-over-TLS support. Reads as English: doggo example.com MX @1.1.1.1.
Rust alternative to doggo — same idea, slightly different output. Pick whichever you like the look of; both are vast improvements over BIND's dig.
Bandwidth-per-process TUI. When "why is the network slow?" needs an answer in under a minute, this tells you exactly which process and which remote address are eating it.
imsnif/bandwhich→ping with a live graph in the terminal. Tiny tool, but you will not go back — when you are debugging an intermittent latency issue, the graph tells the story faster than scrolling text.
Wireshark-style packet inspection in the terminal, on top of tshark. Read a pcap or sniff live; navigate frames, follow streams, filter expressions. Indispensable when SSH is your only window.
Per-interface bandwidth monitor with sparkline graphs. Old, stable, in most distros. Quick way to confirm whether traffic is hitting the right NIC.
tgraf/bmon→Real-time graph of incoming/outgoing bandwidth, split per interface. The classic Linux server "is this link saturated?" check.
rolandriegel/nload→Human-readable HTTP client. http POST api.example.com/users name=Inês instead of remembering curl's flag soup. Coloured, formatted JSON output, sessions, plugins.
httpie syntax, Rust speed, single binary. Startup is instant compared to httpie's Python boot. Same flags, drop-in if you already know httpie.
ducaale/xh→Creates a locally-trusted root CA and emits TLS certs for whatever hostnames you ask. No more "your connection is not private" red banner when developing against https://*.dev.local.
The port scanner. Banner detection, OS fingerprinting, script engine. Old, ubiquitous, still the right tool for "what is exposed on this subnet?" — though use it on networks you own, please.
nmap/nmap→Cloudflare's tunnel CLI — expose a local port to the public internet via Cloudflare's edge. OSS daemon, free for the basic case, no NAT/firewall surgery needed. Useful for webhooks during dev.
cloudflare/cloudflared→Networking tools age slowly — nmap from 1997 is still on this list — so the curation here is more about replacing the rusty defaults (dig, traceroute, ping) with their modern equivalents and noting the niche TUIs that justify themselves when SSH is your only window.