A service is unreachable. How do you troubleshoot it systematically?

Summary

Work up the layers from the client: does DNS resolve to the expected address; is there a route; does a TCP connection open (timeout suggests filtering, 'connection refused' suggests nothing listening); does TLS validate; what does HTTP return; is the app listening on the right address? Then use flow logs and reachability tools to find the blocking rule.

Longer Answer

Commands: dig, ip route get, nc -vz host port, openssl s_client, curl -v, ss -tlnp, tcpdump. Cloud: VPC Flow Logs, Reachability Analyzer, Azure Network Watcher, Google Cloud Connectivity Tests. Don't rely on ping; ICMP is often blocked.

Key Points

• DNS -> route -> TCP -> TLS -> HTTP -> app.
• Timeout vs refused tells you a lot.
• Flow logs show accepts and rejects.
• Ping alone proves nothing.

Deep dive: Networking Tutorial: Network Troubleshooting

What interviewers look for

A methodical approach and interpretation of symptoms.