Practice: Five Symptoms, Five Layers

A timeout, a refused connection, a certificate error, an NXDOMAIN and a 503; name the layer and the first tool for each.

Naming the layer from the symptom, and the tool that tests it, is the core of debugging by layer. A service is called from a laptop, and five different days bring five different errors.

curl: (28) Failed to connect to api.example.com port 443: Connection timed out
curl: (7) Failed to connect to api.example.com port 443: Connection refused
curl: (60) SSL certificate problem: certificate has expired
dig api.example.com returns status NXDOMAIN
The response is 503 Service Unavailable from the load balancer

For each, name the layer that failed and the first tool to run next.

Show the answers

Each symptom, the layer it points to, and the first tool
Symptom	Layer	First tool	Why
Timed out	3 or a firewall at 4	traceroute, then the security group rules	No reply at all: a route or a filter dropped the SYN
Refused	4, the transport	nc -vz, then ss -tlnp on the host	The host replied with a reset: nothing listens on 443
Certificate expired	TLS	openssl s_client -connect api.example.com:443	TCP worked; the certificate's dates do not include today
NXDOMAIN	Application, DNS	dig @ the authoritative server	The name does not exist, in the zone or in a typo
503 from the load balancer	7, behind the proxy	curl -v, then the target group's health	Every layer to the load balancer worked; it has no healthy target

The order of the first four follows the order of setup: a symptom later in the list proves every step before it succeeded.

← → move through sections and cards