Block a connection at each of the four layers in turn

short · 50 min · Objective 6.2

Task

Break the same connection four different ways and learn to tell the causes apart from the symptom alone. Timeout versus refused is the single most useful distinction in network troubleshooting, and this lab makes it concrete.

Steps

  1. Establish a working connection from host A to a service on host B, and record the normal behaviour in lab/net/layers.md.
  2. Fault one -- ROUTING: remove the route from A to B's network. Attempt the connection and record the exact symptom and how long it took.
  3. Fault two -- STATELESS FILTER: restore routing, then add a subnet-level rule permitting inbound on the service port but NOT the ephemeral return range. Record the symptom.
  4. Fault three -- STATEFUL FILTER: restore, then block the port at the instance level. Record the symptom.
  5. Fault four -- SERVICE NOT LISTENING: restore everything, then bind the service to loopback only. Record the symptom, and write the table mapping each of the four symptoms to its cause.

Verify

grep -Eci 'timeout|timed out|hang' lab/net/layers.md
grep -Eci 'refused' lab/net/layers.md
grep -Eci 'ephemeral' lab/net/layers.md
grep -Eci 'loopback|listening' lab/net/layers.md

All four non-zero. Three of the faults should produce a timeout and one should produce a refusal -- if they all look the same, the service is behind something that swallows the reset and the distinction is being hidden.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.