>

Show WireGuard VPN status with wg show

See whether the tunnel is alive, when peers last handshook and how much traffic flowed.

LinuxnetworkwireguardtroubleshootingvpnMedium risk
Run sudo wg show to list interfaces, peers, latest handshake time and transfer counters — no handshake for 2+ minutes usually means the tunnel is dead.

01Command

Command
$ sudo wg show

02What it does

wg show dumps the runtime state of WireGuard interfaces: the public key, listening port, each peer's endpoint, allowed IPs and — the parts that matter when debugging — latest handshake and transfer bytes. A fresh handshake (under ~2 minutes old) with growing transfer means the tunnel works; a stale handshake points to blocked UDP, wrong keys or a downed endpoint. sudo wg show wg0 limits output to one interface.

03Risk

RiskMedium risk
Requirementswireguard-tools package (wg command). Root needed to read the interface config and public keys; the wg0 interface itself comes from wg-quick or NetworkManager.
!Warning: wg show prints public keys and endpoints, not the private key, but still treat the output as sensitive. wg show can read state even when no traffic is flowing — pair it with ping across the tunnel to test actual reachability, since a handshake alone proves only key exchange succeeded.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • wg(8) — Debian bookworm
    Debian Manpages · community · 2026-09-17
    Evidence: Same wg(8) manual: show command reports current configuration and runtime status including latest-handshakes and transfer counters.
  • wg(8) — Arch Manual Pages
    Arch Linux · community · 2026-09-17
    Evidence: Documents wg show and its output sections: peer public keys, latest handshakes, transfer (received/sent) and endpoint addresses.

Last verified: 2026-09-19 · Category: Network

06Related solutions

Show IP addresses in a compact table with `ip -br a`
Linuxifconfignetworktroubleshooting

One command that prints every interface with its state and IPv4/IPv6 addresses in a short table — the modern, memorable replacement for digging through `ifconfig` or the verbose `ip addr` output.

Low risk ✓ 2026-09-17
View the routing table and default gateway with `ip route show`
Linuxroutinggatewaytroubleshooting

The routing table is the first thing to check when traffic leaves the wrong interface or the gateway seems dead — and `ip route show` is the quick, modern way to read it.

Low risk ✓ 2026-09-17
Check if a remote port is open with `nc -zv`
Linuxncportnetcat

The fastest way to answer 'is the firewall blocking me?' — netcat in scan mode attempts one TCP connection and prints whether it succeeded.

Low risk ✓ 2026-09-17