One Tool per Layer: ping, traceroute, dig, nc, openssl and curl

Each tool proves one layer works, so the first tool that fails names the layer that is broken.

Each common network tool tests one layer, and its success proves that layer and the ones beneath it work. Run them in order of layer, and the first one that fails names the layer that is broken. Each also proves less than it seems to, and knowing that limit is half of using it.

Common tools, the layer each tests, and what success does and does not prove
Tool	Layer	Success proves	It does not prove
ip neigh or arp -a	2, the link	The gateway's MAC address is known	Anything beyond the local network
ping host	3, the network	The host answers ICMP echo	That any port is open; failure may only mean ICMP is blocked
traceroute host	3, the network	The routers on the path, hop by hop	That replies come back the same way
dig name	Application, DNS	What the name resolves to, and the TTL	That the address is the right one
nc -vz host port	4, the transport	Something accepts TCP connections on the port	That it speaks the protocol you expect
openssl s_client -connect host:443	TLS	The handshake completes; shows the certificate chain	That the application behind it works
curl -v URL	7, the application	The HTTP response, with every layer below shown	That a browser would render the page

Run them in layer order. dig first, because nothing else works without an address. Then nc -vz to the port, which proves the route and the firewall in one step. Then openssl s_client for the certificate, and curl -v for the response.

curl -v shows several layers at once. Its verbose output prints the address it resolved, "Connected to" when TCP succeeds, the TLS handshake and certificate, then the request and response headers. Where the output stops is where the failure is.

ping misleads in both directions. Many hosts and cloud firewalls drop ICMP, so a host that ignores ping may serve web pages perfectly. And a host that answers ping may have nothing listening on the port that matters.

dig can ask a chosen server. dig @8.8.8.8 name asks a public resolver, and dig @ns1.example.com name asks the authoritative server directly, which separates a stale cache from a wrong record.

So pick the tool that tests the layer in question, and trust only what its success actually proves.

← → move through sections and cards