Old vs New Linux Commands

Linux is old enough that most tasks have an "old way" and a "new way". Old blog posts, exam questions, interview questions and scripts written ten years ago still use commands such as ifconfig, netstat and service. Some of these no longer exist on a fresh Ubuntu 26.04 system; others still work but are no longer the recommended tool.

This lesson collects those pairs in one place, explains why each change happened, and shows what to do when you meet an old command. Knowing both sides lets you read any guide and still write modern, supportable commands.

The quick reference

Networking: net-tools to iproute2

ifconfig, route, arp and netstat come from the net-tools package. They were the standard tools for decades, but net-tools stopped being actively developed long ago and cannot show or configure several features of the modern kernel networking stack. Their replacements, ip and ss from the iproute2 package, are installed everywhere. On a new Ubuntu system, the old commands are simply missing:

ifconfig

Command 'ifconfig' not found, but can be installed with:
sudo apt install net-tools

You can install net-tools to follow an old guide, but it is better to translate. Most ifconfig output has an exact equivalent: ip -br address for a summary, ip address show eth0 for details, and ip -s link for packet counters. ss is also faster than netstat on busy servers, because it reads socket information directly from the kernel.

Services: init scripts to systemd

Before systemd, each service was started by a shell script in /etc/init.d/, and "runlevels" (numbers 0 to 6) described the state of the system. Ubuntu switched to systemd in 2015. systemd starts services in parallel, restarts crashed ones, tracks every process in a service, and logs their output to the journal, none of which the old scripts could do reliably.

sudo service nginx restart
sudo systemctl restart nginx

Both lines work on Ubuntu 26.04: service is kept for compatibility and simply passes the request to systemctl. Write systemctl in anything new, and learn the target names that replaced runlevels: multi-user.target for a text-mode server, graphical.target for a desktop, and rescue.target for repair.

Packages: apt-get, apt and apt-key

apt was introduced to combine the most-used parts of apt-get and apt-cache with friendlier output, colours and progress bars. But its output may change between versions, so apt itself warns when used in a pipe:

apt list --installed | head -n 2

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Listing...

So the rule is: type apt at the terminal, but in scripts and Dockerfiles use apt-get (and apt-cache, dpkg-query), whose output and options are kept stable. Both use the same package database, so mixing them is safe.

apt-key was different: it added keys that every repository could use, so one vendor's key could sign packages that replaced Ubuntu's own. It was deprecated for years and has been removed in Ubuntu 26.04 (APT 3.1). Old instructions that say curl ... | sudo apt-key add - fail; save the key in /etc/apt/keyrings/ and reference it with Signed-By instead, as shown in Package Management.

Shell scripting: old habits

Several old shell habits still run but have better replacements:

files=`ls /etc | wc -l`
files=$(ls /etc | wc -l)
egrep 'error|fail' app.log
grep -E 'error|fail' app.log

egrep: warning: egrep is obsolescent
09:14:07 ERROR payment gateway timeout
09:14:07 ERROR payment gateway timeout

Backticks cannot be nested without awkward escaping and are easy to confuse with single quotes; $( ) nests cleanly. egrep and fgrep now print a warning in GNU grep and may be removed in future, so use grep -E and grep -F. Inside Bash scripts, [[ ]] is safer than [ ] because it does not split unquoted variables and supports &&, || and patterns.

Firewalls: iptables to nftables

iptables was the Linux firewall tool for many years. Its successor, nftables (command nft), uses one tool for IPv4 and IPv6, has a cleaner syntax and handles large rule sets faster. On modern Ubuntu the iptables command still exists, but it writes nftables rules underneath. Most administrators never need either directly: ufw (see Basic Server Hardening) manages the rules for you.

Reading an old guide safely

When a tutorial uses commands you do not recognise, follow this routine:

1. Check the date and the distribution version it was written for.
2. Look up each unfamiliar command with type and man; if it is missing, find its modern equivalent in the table above rather than installing old packages by habit.
3. Watch for removed or unsafe steps: apt-key, chmod 777, disabling the firewall, or piping a website straight into sudo bash.
4. Test on a VM or a snapshot before touching a real server.

Common mistakes

• Installing net-tools just to keep using ifconfig. Learn ip; it is everywhere and it is what current documentation uses.
• Using apt in scripts. Its output is not stable; use apt-get.
• Following apt-key instructions on Ubuntu 26.04. The command is gone; use keyrings and Signed-By.
• Mixing init scripts and systemd. Calling /etc/init.d/ scripts directly bypasses systemd's tracking. Use systemctl.

Key points

• ip replaces ifconfig, route and arp; ss replaces netstat; dig replaces nslookup.
• systemctl replaces service, /etc/init.d scripts, update-rc.d and runlevels.
• Use apt interactively and apt-get in scripts; apt-key has been removed in favour of Signed-By keyrings.
• Prefer $( ), [[ ]], grep -E and grep -F over backticks, [ ], egrep and fgrep.
• nftables replaces iptables, usually managed through ufw; Ed25519 replaces old DSA and short RSA SSH keys.

ip address show eth0
sudo ss -tlnp | grep ':80 '
sudo systemctl restart mysql
sudo systemctl enable mysql
apt search redis
today=$(date +%F)
grep -Ec '" (404|500) ' access.log

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether f2:3c:94:12:34:56 brd ff:ff:ff:ff:ff:ff
    inet 203.0.113.10/24 metric 100 brd 203.0.113.255 scope global dynamic eth0
...