Troubleshooting by Layer: Bottom Up or Top Down

Start where the symptom points, and move one layer at a time until something works.

Troubleshooting by layer means testing one layer at a time and proving it works before moving to the next, so the fault is narrowed to one layer instead of guessed at across all of them. Bottom up starts at the physical link and climbs; top down starts at the application and descends. The symptom decides which end to start from.

Where should the investigation start?

When Nothing on the machine reaches anything, or only one machine is affected
, choose
Bottom up, from the link and the local address.
When An error message names a layer, such as NXDOMAIN, connection refused or a certificate error
, choose
At that layer, then one layer down to confirm what it rests on.
When The application returns an HTTP error, such as a 502 or a 500
, choose
Top down, since every layer below already worked to carry the error back.
When The symptom is vague, such as "slow" or "sometimes fails"
, choose
In the middle, with a connection test to the port, then up or down depending on the result.

Bottom up. Is the cable or Wi-Fi connected and the address assigned? Is the gateway reachable? Does the name resolve? Does the port answer? Does TLS complete? Does HTTP return what is expected? Each answer that is yes clears a layer. It is thorough and suits faults where nothing works, but it spends time proving layers a clear error already cleared.

Top down. Start with the application's own answer and descend only while the answers are wrong. An HTTP response of any kind, even an error, proves DNS, routing, TCP and TLS all worked, because the response could not have arrived otherwise.

Read the error before choosing. Most tools report the first layer that failed. "Could not resolve host" is DNS. "Connection refused" means the host answered at layer 4 and nothing listens on the port. "Connection timed out" means no answer at all, a route or a firewall. A certificate error means TCP worked and TLS did not.

Prove, do not assume. The commonest mistake is to fix a layer nobody tested: restarting the server when the name does not resolve, or editing firewall rules when the process has crashed. One test per layer, written down with its result, keeps the investigation honest.

So choose the direction from the symptom, and let each layer's result decide the next step.

← → move through sections and cards