Tooling & Debugging

The commands to reach for when something is slow or unreachable. The module opens with a ladder that maps a symptom to the layer and the tool that answers it fastest, then works through the tools: ping and mtr for the path, dig for DNS, ss, nc, lsof and ip for sockets and interfaces, curl and openssl s_client for HTTP and TLS, and tcpdump and Wireshark for the packets themselves. It ends with a lab that reproduces each failure on your own machine so you have seen what it looks like.

What you will be able to answer

• Given a symptom such as "the site is slow" or "connection refused", which layer do you check first and with which command?
• How do you read packet loss, TTL and per-hop latency in ping and mtr without blaming a router that merely rate-limits ICMP?
• What do dig flags like +trace, +short and @resolver tell you, and why can dig resolve a name that your application cannot?
• How do you find which process owns a port, what state a socket is in, and which interface and route a packet will use?
• How do the curl -w timing fields separate DNS, TCP, TLS and server wait, and what does openssl s_client show about a certificate chain?
• How do you capture and filter traffic with tcpdump, and what do retransmissions, resets and the handshake look like in Wireshark?
• How do you reproduce a drop versus a reject, a reset, a connect timeout, and packet loss or latency locally?