A Method for 'It Can't Connect'

In one line

Work from the bottom layer up, change one thing at a time, and use one command per question: name resolution, route, reachability, port, then application.

0/3 · 0%

Think of it like this

A doctor doesn't prescribe before examining. Start with vital signs (is it up? can it resolve? can it reach?) and narrow down, instead of restarting things and hoping.

Key ideas

01
The five questions, in order: 1) Does the NAME resolve to the right address? (dig, getent hosts; Phase 3). 2) Is there a ROUTE? (ip route get; Phase 4). 3) Is the host REACHABLE? (ping, mtr; note ICMP may be blocked). 4) Is the PORT open, and what's the result: refused or timeout? (nc -vz, curl -v; Phase 2). 5) Does the APPLICATION answer correctly? (curl -v, logs).
02
Where you test from matters: your laptop, the source host, the source container, the source pod. Each has its own DNS configuration, routes, and security groups or NetworkPolicies. Reproduce from the actual source (kubectl exec, docker exec, Session Manager).
03
'Refused' vs 'timeout' (Topic 2.2) is the most useful single clue: refused means reachable but nothing listening (or the wrong port); timeout means something is silently dropping (a security group, NACL, NetworkPolicy, or missing route).
04
Keep a record as you go (what you tested, from where, and the result). It speeds up the investigation and becomes the incident timeline (SRE course, Shift 0.3).

Code & diagrams

five-questions.shbash

getent hosts db.internal                  # 1. name → address
ip route get 10.20.20.15                  # 2. route and source IP
mtr -rwc 10 10.20.20.15                   # 3. reachability and loss per hop
nc -vz -w 3 10.20.20.15 5432              # 4. port: refused vs timeout
curl -sv http://10.20.20.15:8080/healthz  # 5. application response

Explain it without notes

Why test from inside the pod or container rather than from your laptop?

Practice

An app gets 'timeout' connecting to a database, but nc -vz from the same host succeeds. What might differ?

Trade-offs

↔
A methodical bottom-up approach feels slower than guessing, but it's consistently faster on unfamiliar problems and produces evidence other people can verify.

Done when you can

I can run the five-question check from the right source.
I interpret refused vs timeout correctly.
I record my tests as I go.