Network Debugging & Capstone
"Why can’t I connect?" as a layered procedure, the tools and which layer each answers, DNS/TCP/TLS/HTTP debugging — and the capstone: what happens when you visit `https://example.com`.
Every connection failure lives in exactly one layer, and the fastest way to find it is to bisect the ladder — DNS, route, host, port, handshake, TLS, HTTP, application — reading the failure signature at each step instead of guessing.
ping, traceroute, dig, curl, ss, tcpdump, Wireshark, nc and openssl are not a list to memorise; each one asks a question at one layer and is blind to the others, so choosing the tool is choosing the layer you are testing.
ping sends an ICMP echo request and reports whether a reply came back and how long it took; that answers "does this host respond to ICMP right now" and nothing else — a failed ping does not mean a service is down and a successful ping does not mean it is up.
traceroute sends probes with TTL 1, 2, 3… and collects the ICMP Time Exceeded replies each router returns when it discards them, revealing the forward path one hop at a time — and the same mechanism is why the output is full of honest-looking lies.
A name lookup can be answered by half a dozen different caches and resolvers before it reaches anyone authoritative, so the first question in every DNS problem is "which of them answered?" — and `dig` against a chosen server, `+trace` and the TTL in the answer will tell you.
"Connection times out" has exactly three wire signatures — SYN/SYN-ACK/ACK, SYN then RST, or SYN into silence — and one `ss` on the server plus one `tcpdump` on each end converts a vague timeout into a named cause: nothing listening, wrong bind address, dropped by a firewall, host down, backlog full or ephemeral ports exhausted.
"Certificate invalid" is the browser’s summary of six unrelated faults — wrong name, expired, missing intermediate, wrong clock, wrong certificate for the SNI, protocol or cipher mismatch — and `openssl s_client` plus `curl -v` name which one in a single line each.
The three gateway errors usually describe three different upstream situations — 502 the backend answered wrongly or closed, 503 no backend was available, 504 the backend did not answer in time — and the debugging procedure is to find which hop generated the status, correlate with that hop’s upstream logs and health state, and check that the timeout ladder is ordered.
The canonical networking interview question is a test of whether you can tell the story at the right altitude — nine steps in a minute, twelve layers on request, and at every layer the mechanism, the state that changes, and the failure you would name.