Core Command-Line Network Tools: iPerf3, MTR, tcpdump, and cURL

Modern graphical user interfaces and web-based dashboards provide high-level summaries of infrastructure health, but when complex routing faults, interface packet drops, or application latency degradations occur, systems engineers rely on command-line utilities [1, 2].

The standard Linux and Unix command-line networking toolkit provides raw, unmediated access to transport layer sockets, packet capture drivers, and routing engines [2, 3]. In this technical guide, we examine four indispensable command-line utilities—iPerf3, MTR, tcpdump, and cURL—explaining their operational mechanics, practical syntax flags, and diagnostic interpretations [1, 2, 3].

1. iPerf3: Active Bandwidth Benchmarking

While public web speed tests measure throughput across untrusted public internet routes, iperf3 measures the raw point-to-point bandwidth capacity of dedicated physical links, VLAN trunks, and VPN tunnels [1, 2]:

Client-Server Architecture

iPerf3 requires two active instances: a listening server and a sending client [1]:

# On Server (Receiver):
iperf3 -s -p 5201

# On Client (Sender) - Default 10-second TCP benchmark:
iperf3 -c 192.168.10.50 -p 5201

Essential iPerf3 Diagnostic Flags

• -P 4 (Parallel Streams): Initiates 4 concurrent TCP streams to evaluate link capacity under multi-stream conditions [2].
• -u -b 1G (UDP Mode): Tests raw physical line-rate capacity and measures packet jitter and packet loss ratio without TCP window collapse [1].
• -R (Reverse Mode): Reverses direction (server transmits data, client receives), enabling rapid upload/download symmetry testing [1].
• -w 2M (Window Size): Manually overrides TCP receive window buffer sizes to verify whether network throughput is constrained by memory allocation [2, 3].

2. MTR (My Traceroute): Continuous Path Telemetry

Standard traceroute probes each router hop exactly three times and exits, missing intermittent packet loss and transient routing flaps [1]. mtr combines ping and traceroute into a continuous, real-time diagnostic engine:

# Run continuous live interactive report
mtr 8.8.8.8

# Generate a non-interactive 100-packet statistical text report
mtr --report --report-cycles=100 8.8.8.8

Key Output Columns:

• Loss%: Percentage of packets dropped at that specific hop [1].
• Avg / Best / Wrst: Round-trip latency statistics over the entire test duration.
• StDev (Standard Deviation): High standard deviation indicates severe jitter and buffer queuing variance [1].

3. tcpdump: Protocol-Level Packet Capture

When an application fails to communicate over an apparently healthy network link, tcpdump captures and analyzes raw Layer 2–4 Ethernet frames and IP packets [2, 3]:

# Capture packets on interface eth0 matching host and port
sudo tcpdump -i eth0 host 192.168.1.100 and port 443 -nn -vv

Critical Syntax Modifiers:

• -nn: Prevents tcpdump from converting IP addresses to hostnames and port numbers to service names. This eliminates DNS lookup overhead, preventing packet drops during high-speed captures [2].
• -w capture.pcap: Writes raw packet frames directly to disk for in-depth dissection inside Wireshark [3].
• tcp[tcpflags] & (tcp-syn|tcp-rst) != 0: Advanced Berkeley Packet Filter (BPF) syntax filtering exclusively for TCP connection initiation (SYN) or abrupt connection aborts (RST) [2].

4. cURL: Precision Web Performance Profiling

While curl is widely utilized to transfer files and query REST APIs, it is also a precision instrumentation tool for profiling HTTP/HTTPS connection phases [2]:

# Profile detailed connection milestones in seconds
curl -w "\nDNS Lookup:        %{time_namelookup}s\n\
TCP Handshake:     %{time_connect}s\n\
TLS Handshake:     %{time_appconnect}s\n\
Time to First Byte: %{time_starttransfer}s\n\
Total Time:        %{time_total}s\n" \
-o /dev/null -s https://deprogit.com

Breaking Down the Waterfall Metrics:

• time_namelookup: Time required to complete DNS resolution [2].
• time_connect: Time required to complete the initial TCP 3-way handshake (reflects true network RTT) [2].
• time_appconnect: Time elapsed after completing TLS certificate validation and cipher negotiation [2].
• time_starttransfer (TTFB): Time until the remote web server begins sending HTTP response data (reflects backend application and database processing latency).

Core CLI Network Utilities Comparison

Practical Diagnostic Workflow

When troubleshooting a suspected network or application failure:

1. Verify Interface Link & Bandwidth: Execute iperf3 between client and local server to eliminate local LAN bottleneck concerns [1].
2. Profile Hop Latency: Run mtr against external targets to detect whether carrier peering routes are experiencing sustained packet drops [1].
3. Capture Traffic for Handshake Validation: If connection timeouts occur, execute tcpdump to verify whether TCP SYN packets receive SYN-ACK responses or are dropped by intermediate firewalls [2].
4. Isolate Backend vs Network Latency: Run curl waterfall profiling to determine whether slow web responses stem from network transit delay or backend database processing [2].

For enterprise systems monitoring, performance tuning, and managed infrastructure architecture, explore our capabilities on our IT Infrastructure & System Integration page.

Key Takeaways

• iPerf3 provides authoritative point-to-point throughput benchmarking across LAN, VLAN, and VPN links.
• MTR runs continuous multi-cycle traceroute telemetry to detect intermittent routing drops and jitter.
• tcpdump inspects raw packet frames and TCP flags, isolating firewall drops and connection resets.
• cURL waterfall profiling breaks web performance down into DNS, TCP, TLS, and TTFB latency components.

Need help with this? Contact us.

Sources

[1] IETF, "RFC 2544: Benchmarking Methodology for Network Interconnect Devices", 1999. URL: https://www.rfc-editor.org/rfc/rfc2544.html (Standards-track benchmarking methodology for network throughput, latency, and packet loss measurements).

[2] IETF, "RFC 793: Transmission Control Protocol", 1981. URL: https://www.rfc-editor.org/rfc/rfc793.html (Standards-track foundational specification establishing TCP connection establishment, window scaling, and flow control).

[3] The Linux Kernel Organization, "The Linux Kernel Documentation: Scaling in the Linux Networking Stack", 2024. URL: https://www.kernel.org/doc/html/latest/networking/scaling.html (Technical documentation covering socket buffer management, receive-side packet queues, and networking stack scaling).

Last reviewed: October 2026