Use curl --resolve and --connect-to to test DNS and proxy boundaries
--resolve supplies an address for a host and port while retaining the URL host for TLS and HTTP; --connect-to changes the network destination without rewriting application authority.
Use dig to separate resolver, authority, and cache failures
Dig can ask the configured resolver, a chosen recursive resolver, or an authoritative server; comparing those paths identifies where answers diverge.
Read ethtool link speed and counters without assuming cable failure
Ethtool reports negotiated link properties and driver counters, but counter names and reset behavior depend on the device and driver.
Use ip route get to prove the Linux route for one destination
Ip route get asks the kernel how it would route a specific flow, including source address, interface, gateway, table, and policy results.
Inspect Linux conntrack pressure before raising the limit
Connection tracking records flow state for firewall and NAT decisions; usage, timeout mix, and packet rate explain pressure better than one maximum value.
Open a Linux firewall port only after proving the listener and path
A usable port requires a process listener, correct bind address, route, firewall admission, and often an upstream cloud or provider rule.
mtr vs traceroute: interpret path evidence without blaming one hop
Traceroute samples TTL-limited replies while mtr repeats them; intermediate response loss does not prove forwarding loss when later hops and application traffic succeed.
Use ss to identify the process listening on a Linux port
Ss reads kernel socket state and can show local addresses, ports, processes, queues, and TCP details without probing the network path itself.
Debug systemd-resolved by link, search domain, and server
Systemd-resolved can maintain per-link DNS servers and routing domains, so /etc/resolv.conf alone may not describe the effective lookup path.
Practical tcpdump filters for bounded incident evidence
Tcpdump captures packets visible at an interface and filter boundary; it proves observed traffic, not packets dropped before capture or decrypted application meaning.
Load an SSH FIDO resident key
The key handle is stored on a FIDO2 authenticator and must be discovered or loaded on a new client without exposing private material.
Hashed SSH known_hosts entries
The known_hosts file hides hostnames with keyed hashes, making manual searches confusing while preserving host-key verification.
SSH MFA prompt missing
The expected TOTP, push, or broker challenge never appears because client methods, sshd AuthenticationMethods, PAM, or non-interactive execution do not align.
Should SSH compression be enabled
The user wants faster SSH or file transfer but must determine whether compression helps the actual data and bottleneck.
Use SSH over port 443
A network blocks outbound port 22, so the operator considers an official SSH endpoint on TCP 443 or a controlled alternate listener.
Incomplete TLS certificate chain: why browsers disagree
The search intent behind this problem is proving whether the server sends required intermediates.
Connection refused vs no route to host
The search intent behind this problem is deciding whether to inspect the service, firewall, or path.
curl timing breakdown: DNS, connect, TLS, first byte, and total
The search intent behind this problem is locating latency without a full tracing platform.
DNS propagation is usually caching: measure the actual TTL
The search intent behind this problem is diagnosing inconsistent answers after a record change.
DNS SERVFAIL vs NXDOMAIN: stop treating them as the same
When separating resolver failure from an authoritative negative answer, speed comes from ordering the investigation—not from typing more commands.
Ephemeral port exhaustion: the hidden client-side outage
When finding excessive outbound connection churn, speed comes from ordering the investigation—not from typing more commands.
HTTP 502 vs 503 vs 504: use the status as a starting clue
When mapping gateway errors to upstream response, availability, and timeout, speed comes from ordering the investigation—not from typing more commands.
IPv6 works but IPv4 fails—or the reverse
The search intent behind this problem is testing address families as separate production paths.
Service listens on localhost but not the network
The search intent behind this problem is fixing bind address without exposing more than intended.