Work the layers to find where it breaks

short · 30 min · Objective 5.3

Task

Practise the fixed diagnostic order against three planted network faults, and identify at which layer each appears. The sequence is the skill: the same symptom -- "it does not work" -- resolves to a different layer each time, and guessing is slower than working up.

Steps

  1. For each fault, work strictly up the layers: ip link (carrier), ip addr (address), ip route (gateway), ping the gateway, ping 8.8.8.8, dig, then curl. Note the FIRST step that fails.
  2. The DNS case: confirm ping 8.8.8.8 works and ping name does not, and stop there -- that pattern is DNS, always. Check /etc/resolv.conf, /etc/nsswitch.conf, and getent hosts.
  3. The routing case: confirm "Network is unreachable" rather than a timeout, and that ip route shows no default. Distinguish the message from a firewall drop.
  4. The bind-address case: confirm the service works locally and not remotely, and that ss -tlnp shows 127.0.0.1. The firewall is irrelevant here.
  5. The firewall case: confirm a TIMEOUT rather than a refusal, and that the port is open in ss locally. Refused is fast, dropped is slow.
  6. For each, write the single observation that identified the layer.

Verify

# DNS signature:
ping -c1 8.8.8.8 >/dev/null 2>&1 && ! getent hosts example.com >/dev/null 2>&1 && echo "DNS: IP works, name does not"
# routing signature:
ip route show default | grep -q . || echo "no default route -- Network is unreachable"
# bind signature:
ss -tlnp | grep ':80 ' | grep -q '127.0.0.1' && echo "bound to loopback only"

Each check encodes one signature. "IP works, name does not" is DNS and needs no firewall investigation; "Network is unreachable" is a missing route and not a timeout; loopback-only bind is unreachable remotely whatever the firewall says.

Notes

ping 8.8.8.8 succeeding while ping google.com fails is the fastest diagnosis in networking: routing, gateway and interface are all proven working, so only name resolution is left. Work up the layers and stop at the first failure rather than theorising from the symptom.