6.3. Network Troubleshooting

Network problems are especially challenging because they can originate at any layer and the symptoms (connection timeout, name resolution failure, certificate error) often don't directly indicate the layer. Systematic layer-by-layer diagnosis is essential.

💡 First Principle: The OSI/TCP-IP model provides a diagnostic framework: physical link → IP address → routing → DNS → firewall → application. Test each layer in order. If ping to the gateway works but ping to the internet doesn't, the problem is upstream routing, not your network configuration. Each layer that works rules out an entire class of problems.

⚠️ Common Misconception: DNS failures and network failures look identical from an application perspective — both produce "cannot connect" errors. Before assuming a network problem, test DNS explicitly with dig or nslookup. Many "network outages" are actually DNS resolver failures resolved by changing /etc/resolv.conf.

Network problems are invisible until they aren't — connectivity fails suddenly, with no obvious cause, affecting every dependent service simultaneously. A systematic layer-by-layer approach (physical → link → IP → DNS → application) cuts diagnostic time from hours to minutes.