Lab: inspect a network path

Prerequisites: the four foundation lessons and a terminal on your own computer. Outcome: write a connection description that another engineer can reproduce. Allow: 20 minutes.

1. Write the connection you want to inspect

Use an application or lab service that you are authorized to access. Record its hostname, transport protocol, destination port, and the operation that fails. For example: “This client cannot open its UDP media session, but its HTTPS request over TCP succeeds.” Use the real service address for live checks. The documentation addresses in the previous lessons are only examples.

2. Read the interface addresses

Use the command for your operating system:

System	Command
Linux	`ip -brief address`
macOS	`ifconfig`
Windows PowerShell	`Get-NetIPAddress`

Find the interface that you expect to carry the traffic. Record its address and prefix length. Expect additional entries for loopback, VPNs, containers, and unused interfaces. An address on an interface does not prove that a route selects that interface.

3. Read the DNS result

The following script uses your operating system’s name-resolution configuration. Save it as resolve_host.py:

import socket
import sys

if len(sys.argv) != 2:
    raise SystemExit("usage: python3 resolve_host.py HOSTNAME")

try:
    results = socket.getaddrinfo(
        sys.argv[1], 443, type=socket.SOCK_DGRAM
    )
except socket.gaierror as error:
    raise SystemExit(f"name resolution failed: {error}")

addresses = sorted({result[4][0] for result in results})
for address in addresses:
    print(address)

Run python3 resolve_host.py localhost first. The output should contain a loopback address such as 127.0.0.1 or ::1, depending on local configuration. Then replace localhost with the service hostname. On Windows, use py -3 instead of python3 if necessary. The service result varies with your resolver and the current DNS records. SOCK_DGRAM selects UDP-compatible address records; it does not send a UDP probe or prove that port 443 is reachable.

4. Read the selected route

For IPv4, replace ADDRESS below with one resolved service address. The example commands read routing information; they do not create routes.

System	Command
Linux	`ip route get ADDRESS`
macOS	`route -n get ADDRESS`
Windows PowerShell	`Find-NetRoute -RemoteIPAddress ADDRESS`

Record the selected interface, source address, and next hop, when the output provides them. An on-link destination can have no separate gateway. For IPv6 on Linux, use ip -6 route get ADDRESS. For IPv6 on macOS, use route -n get -inet6 ADDRESS. If the VPN receives traffic that you expected on Wi-Fi, compare the matching prefixes. Use the longest-prefix exercise from the routing lesson to explain the result.

5. Separate reachability from application success

Read the application’s connection error and logs. Record the actual resolved address if the application exposes it. It might select a different address from the one you inspected manually. A successful ping checks an ICMP exchange, not your service’s TCP or UDP behavior. A failed ping is also inconclusive when a network filters ICMP. Use the actual client to check the required application connection. Do not conclude that authentication succeeded merely because a socket opened. Use the application’s accepted-session or accepted-operation evidence.

6. Write the result

Complete this template:

Time and timezone:
Client OS and application version:
Requested hostname:
Resolved addresses:
Address selected by the application, if known:
Transport protocol and destination port:
Selected interface, source address, and route:
Last operation that succeeded:
First operation that failed:
Exact error, with credentials removed:
Next check and the question it answers:

Do not paste credentials into the result. The next check should answer one question, such as whether the service received the connection attempt.

Exercise and worked answer

An engineer reports this fictional result:

DNS result: 10.42.8.150
Selected route: 10.42.8.128/26 through the VPN
Browser portal request: succeeds over TCP
Media session: times out over UDP

What does this establish, and what should the engineer check next?

Worked answer

DNS supplied an address, and route selection chose the VPN. The portal request establishes success for that TCP operation only. The evidence does not establish whether the UDP attempt reached the media service. Check the VPN policy and destination service logs for the actual UDP address and port. Keep the hostname and operation fixed while collecting the next result.

Completion check: produce the filled template and explain one conclusion that the collected evidence does not support. The commands changed no network configuration. Delete resolve_host.py if you no longer need it. Next: 101 · Networking fundamentals.

Start here

100 · Network foundations

101 · Real-time transport

102 · The stack

103 · Build and diagnose

1. Write the connection you want to inspect

2. Read the interface addresses

3. Read the DNS result

4. Read the selected route

5. Separate reachability from application success

6. Write the result

Exercise and worked answer

​1. Write the connection you want to inspect

​2. Read the interface addresses

​3. Read the DNS result

​4. Read the selected route

​5. Separate reachability from application success

​6. Write the result

​Exercise and worked answer

1. Write the connection you want to inspect

2. Read the interface addresses

3. Read the DNS result

4. Read the selected route

5. Separate reachability from application success

6. Write the result

Exercise and worked answer