Network Troubleshooting Toolkit
When "it does not connect", test each layer from the bottom up. Stop at the first failure: that is where the problem is.
The method
| Step | Question | Command |
|---|---|---|
| 1 | Do I have an address and route? | ip -brief addr, ip route |
| 2 | Does the name resolve correctly? | dig +short host |
| 3 | Can I reach the host? | ping -c 3 host (ICMP may be blocked) |
| 4 | Where does the path stop? | traceroute host or mtr host |
| 5 | Is the port open? | nc -zv host 443 |
| 6 | Does TLS work? | openssl s_client -connect host:443 -servername host |
| 7 | Does the app answer correctly? | curl -v https://host/api/health |
Worked example: "The API is down"
dig +short api.example.com # 203.0.113.20: DNS fine
nc -zv api.example.com 443 # timed out
A timeout on 443 with DNS working points to a firewall or a down host. On the server:
ss -tlnp | grep 443 # nginx is listening on 0.0.0.0:443
sudo ufw status # 443 not allowed
sudo ufw allow 443/tcp
Fixed in four commands, without guessing.
Watching traffic
sudo tcpdump -i any port 5432 -n # see packets to the database
sudo tcpdump -i any host 203.0.113.50 -n # traffic to and from one IP
If packets arrive but no replies leave, the problem is on this machine (firewall, service). If nothing arrives, look upstream.
Common symptoms and causes
| Symptom | Likely cause |
|---|---|
| Works by IP, not by name | DNS |
Works on the server (curl localhost), not from outside |
firewall, or app bound to 127.0.0.1 |
| Connection refused | service not running or wrong port |
| Timeout | firewall dropping packets, wrong IP, host down |
| Certificate error | expired, wrong name, missing intermediate certificate |
| 502 from the proxy | app behind it is down or crashed |
| 504 from the proxy | app is too slow; check timeouts and slow queries |
| Works for some users only | DNS caching, IPv6 vs IPv4, a CDN node, /etc/hosts |
Final exercise
On a practice server, deliberately break things one at a time: stop the app, block port 443, bind the app to the wrong address, point DNS at the wrong IP, let a certificate expire (use a test domain). For each, use only the toolkit above to diagnose it, and write the symptom, the command that revealed it and the fix in your runbook.
I tuoi progressi sono salvati solo in questo browser.
Invia per la revisione (10 punti)