# Host-Based Command Line Mastery

Beyond Nmap: Essential native tools for troubleshooting, forensics, and network mapping.

---

In a Security+ Performance Based Question (PBQ), you are often dropped into a terminal and told to "identify the malicious connection" or "fix the DNS resolution." You won't always have Nmap. You must master the **native binaries** built into Windows, Linux, and macOS.

### 1. netstat (Network Statistics)

_Exam Scenario: "Identify which local process is communicating with a known malicious IP address on the internet."_

```bash
netstat -ano
```

- **-a:** Displays all active connections and listening ports.
- **-n:** Displays addresses and port numbers in numerical form (no DNS lookup).
- **-o:** Shows the **PID (Process ID)** associated with each connection.

**Guru Tip:** Once you find the PID in `netstat`, use `tasklist` (Windows) or `ps` (Linux) to find the name of the actual malware file.

## 2. Domain Diagnostics: NSLOOKUP & DIG

When the network is "slow" or "down," it’s often a DNS issue. Security+ requires you to know how to query specific records.

##### nslookup (Windows/Linux)

Used to query DNS servers. To check a specific record type (like a Mail Server):

```bash
nslookup -type=mx google.com
```

##### dig (Linux/macOS)

The "Domain Information Groper." More detailed and powerful than nslookup:

```bash
dig google.com ANY
```

### 3. Path Analysis: tracert & pathping

If you suspect a "Man-in-the-Middle" attack or a routing loop, you need to see every hop between you and the target.

| Command      | OS         | Benefit                                                   |
|--------------|------------|-----------------------------------------------------------|
| `tracert`    | Windows    | Uses ICMP to show the path to a destination.             |
| `traceroute` | Linux/Mac  | Uses UDP packets to map the network path.                |
| `pathping`   | Windows    | Combines `ping` and `tracert` to show packet loss at specific hops. |

### 4. arp (Address Resolution Protocol)

Crucial for detecting **ARP Poisoning** or **Spoofing** attacks.

**Command:** `arp -a`

**Security+ Catch:** If you see two different IP addresses associated with the _same_ MAC address in the ARP table, you are likely the victim of a Man-in-the-Middle attack.