Network Troubleshooting Toolkit
When "it does not connect", test each layer from the bottom up. Stop at the first failure: that is where the problem is.
The method
| Step | Question | Command |
|---|---|---|
| 1 | Do I have an address and route? | ip -brief addr, ip route |
| 2 | Does the name resolve correctly? | dig +short host |
| 3 | Can I reach the host? | ping -c 3 host (ICMP may be blocked) |
| 4 | Where does the path stop? | traceroute host or mtr host |
| 5 | Is the port open? | nc -zv host 443 |
| 6 | Does TLS work? | openssl s_client -connect host:443 -servername host |
| 7 | Does the app answer correctly? | curl -v https://host/api/health |
Worked example: "The API is down"
dig +short api.example.com # 203.0.113.20: DNS fine
nc -zv api.example.com 443 # timed out
A timeout on 443 with DNS working points to a firewall or a down host. On the server:
ss -tlnp | grep 443 # nginx is listening on 0.0.0.0:443
sudo ufw status # 443 not allowed
sudo ufw allow 443/tcp
Fixed in four commands, without guessing.
Watching traffic
sudo tcpdump -i any port 5432 -n # see packets to the database
sudo tcpdump -i any host 203.0.113.50 -n # traffic to and from one IP
If packets arrive but no replies leave, the problem is on this machine (firewall, service). If nothing arrives, look upstream.
Common symptoms and causes
| Symptom | Likely cause |
|---|---|
| Works by IP, not by name | DNS |
Works on the server (curl localhost), not from outside |
firewall, or app bound to 127.0.0.1 |
| Connection refused | service not running or wrong port |
| Timeout | firewall dropping packets, wrong IP, host down |
| Certificate error | expired, wrong name, missing intermediate certificate |
| 502 from the proxy | app behind it is down or crashed |
| 504 from the proxy | app is too slow; check timeouts and slow queries |
| Works for some users only | DNS caching, IPv6 vs IPv4, a CDN node, /etc/hosts |
Final exercise
On a practice server, deliberately break things one at a time: stop the app, block port 443, bind the app to the wrong address, point DNS at the wrong IP, let a certificate expire (use a test domain). For each, use only the toolkit above to diagnose it, and write the symptom, the command that revealed it and the fix in your runbook.
Ihr Fortschritt wird nur in diesem Browser gespeichert.
Zur Prüfung einreichen (10 Punkte)