Work the layers to find where it breaks

short · 30 min · Objective 5.3

Task

Practise the fixed diagnostic order against three planted network faults, and identify at which layer each appears. The sequence is the skill: the same symptom -- "it does not work" -- resolves to a different layer each time, and guessing is slower than working up.

Steps

  1. For each fault, work strictly up the layers: ip link (carrier), ip addr (address), ip route (gateway), ping the gateway, ping 8.8.8.8, dig, then curl. Note the FIRST step that fails.
  2. The DNS case: confirm ping 8.8.8.8 works and ping name does not, and stop there -- that pattern is DNS, always. Check /etc/resolv.conf, /etc/nsswitch.conf, and getent hosts.
  3. The routing case: confirm "Network is unreachable" rather than a timeout, and that ip route shows no default. Distinguish the message from a firewall drop.
  4. The bind-address case: confirm the service works locally and not remotely, and that ss -tlnp shows 127.0.0.1. The firewall is irrelevant here.
  5. The firewall case: confirm a TIMEOUT rather than a refusal, and that the port is open in ss locally. Refused is fast, dropped is slow. That holds for a rule that DROPS. On RHEL, firewalld's default for traffic nothing allows is to reject it with icmp-host-prohibited, which the client shows instantly as "No route to host" -- fast like a refusal, and worded like a routing fault although routing is fine. Learn all three: timeout (dropped), "Connection refused" (nothing listening, or a TCP reset), "No route to host" with a working route (firewalld's rejection).
  6. For each, write the single observation that identified the layer.

Verify

# DNS signature:
ping -c1 8.8.8.8 >/dev/null 2>&1 && ! getent hosts example.com >/dev/null 2>&1 && echo "DNS: IP works, name does not"
# routing signature:
ip route show default | grep -q . || echo "no default route -- Network is unreachable"
# bind signature:
ss -tlnp | grep ':80 ' | grep -q '127.0.0.1' && echo "bound to loopback only"

Each check encodes one signature. "IP works, name does not" is DNS and needs no firewall investigation; "Network is unreachable" is a missing route and not a timeout; loopback-only bind is unreachable remotely whatever the firewall says.

Notes

ping 8.8.8.8 succeeding while ping google.com fails is the fastest diagnosis in networking: routing, gateway and interface are all proven working, so only name resolution is left. Work up the layers and stop at the first failure rather than theorising from the symptom.

This is an independent study companion for CompTIA Linux+ and is not produced by or endorsed by CompTIA.