CCNA
793 incident response problems that help with CCNA prep.
Read first
When DNS changed but some clients still hit the old backendAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when the DNS record is updated but resolver cache, HTTP/2 keepalive, or client pools hold on to the old target.Network3 min readWhen firewalld looks open but connections keep getting blockedAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when a port rule appears to exist but the connection fails because of zone, runtime/permanent drift, source binding, or an upstream firewall.Network3 min readHow to separate timeout and connection refused by network pathAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when DNS, route, firewall, proxy, and listener states all look like the same connection failure.Network3 min read
Recommended problems
Reviewed problems first, then problems with detailed scenarios.
NETWORK-002Port exhaustion in a high-request segment and kernel tuningCovers how ephemeral ports, TIME_WAIT, and sysctl parameters connect to a service failure.ReviewedNetworkAdvanced30 minProNETWORK-003Capturing HTTP traffic with tcpdump and reading the request flowAn introductory problem for figuring out where request and response break down from packet-capture results.ReviewedNetworkBeginner17 minFreeNETWORK-004DNS resolves on the host but not inside the containerA typical failure that appears when the container runtime's DNS settings and search domains diverge.ReviewedNetworkBeginner16 minFreeNETWORK-006Only the load balancer health check is blocked by the firewall, dropping the whole serviceA situation where the application is fine but a different health-check path policy drains all traffic.ReviewedNetworkIntermediate20 minFreeNETWORK-009An SNI routing problem where the TLS handshake fails only on certain domainsA situation where the certificate is valid but SNI routing is wrong, so only some domains fail.ReviewedNetworkAdvanced24 minProNETWORK-020The CDN cache is fine, but a TLS version difference with the origin fails only miss requestsA situation where most requests are cache hits and look fine, but origin communication breaks only in the cache-miss segment.ReviewedNetworkIntermediate24 minPro
All problems (793)
Could not resolve host: external API calls fail on one server onlyCould not resolve host: external API calls fail on one server only is a hands-on troubleshooting drill. Tell a DNS failure from a connectivity or remote outage. GitHub dns-resolution needs to be checked by narrowing scope, recent change, and the current live signal before roll...ReviewedNetworkBeginner3 minFreeConnection refused vs connection timed out: what is the difference?Connection refused vs connection timed out: what is the difference? is a hands-on troubleshooting drill. Use the kind of connect error to decide where the connection stopped. Network Services And Operations needs to be checked by narrowing scope, recent change, and the current...ReviewedNetworkBeginner3 minFree502 Bad Gateway: every page fails after a PHP upgrade502 Bad Gateway: every page fails (Network Services And Operations) is a hands-on troubleshooting drill. Read nginx's upstream error to see why it cannot reach php-fpm. NGINX Network Services And Operations needs to be checked by narrowing scope, recent change, and the current...ReviewedNetworkBeginner3 minFree504 Gateway Timeout: only the order list fails after a table migration504 Gateway Timeout: only the order list fails is a hands-on troubleshooting drill. A 504 means the upstream answered too slowly; find out why. NGINX Network Services And Operations needs to be checked by narrowing scope, recent change, and the current live signal before rollb...ReviewedNetworkBeginner3 minFreePort times out only from outside: it works on the server itselfPort times out only from outside: it works on the server itself is a hands-on troubleshooting drill. When a port works locally but times out remotely, check the firewall. firewall-policy-basics needs to be checked by narrowing scope, recent change, and the current live signal...ReviewedNetworkBeginner3 minFreeConnection refused only from other servers: curl works on the hostConnection refused only from other servers: curl works on the host is a hands-on troubleshooting drill. Check which address a service listens on. Network Services And Operations needs to be checked by narrowing scope, recent change, and the current live signal before rollback....ReviewedNetworkBeginner3 minFreeNETWORK-064ACL shadow rule blocks load balancer health checks from the SNAT poolUser traffic seems permitted on paper, but backends stay marked unhealthy because the firewall never allowed the translated health-check source range.ReviewedNetworkIntermediate18 minFreeNETWORK-041OSPF neighbors stay in EXSTARTBoth routers can ping each other, but adjacency never reaches full because one side advertises a different interface MTU on the same link.ReviewedNetworkIntermediate21 minFreeNETWORK-006Only the load balancer health check is blocked by the firewall, dropping the whole serviceA situation where the application is fine but a different health-check path policy drains all traffic.ReviewedNetworkIntermediate20 minFreeNETWORK-027Resolver search suffix turns short name into wrong destinationResolver search suffix turns short name into wrong destination is a hands-on troubleshooting drill. A short hostname works in one environment and points somewhere else in another because search suffix order changed. DNS and Routing needs to be checked by narrowing scope, recen...ReviewedNetworkBeginner13 minFreeNETWORK-004DNS resolves on the host but not inside the containerA typical failure that appears when the container runtime's DNS settings and search domains diverge.ReviewedNetworkBeginner16 minFreeNETWORK-003Capturing HTTP traffic with tcpdump and reading the request flowAn introductory problem for figuring out where request and response break down from packet-capture results.ReviewedNetworkBeginner17 minFreeNETWORK-1613A DNS server is reachable and one zone still failsOne zone still fails after changing a DNS forwarder.ReviewedNetworkBeginner6 minFreeNETWORK-1611A trunk link comes up and one VLAN still failsOne VLAN still fails right after a renumbering change.ReviewedNetworkBeginner6 minFreeNETWORK-1615A BGP session comes up and traffic still exits wrongTraffic still exits the old path after a BGP preference change.ReviewedNetworkBeginner7 minFreeNETWORK-1626A DNS failover rule is ready and one check still failsOne DNS failover probe still fails after an endpoint move.ReviewedNetworkBeginner7 minFreeNETWORK-024Firewall allow rule exists but interface match is wrongFirewall allow rule exists but interface match is wrong is a hands-on troubleshooting drill. The rule looks present, yet traffic still drops because it is attached to a different input interface than expected. Firewall and Proxy Paths needs to be checked by narrowing scope, re...ReviewedNetworkBeginner14 minFree504 Gateway Timeout: a slow export endpoint behind a 60-second proxy timeout504 Gateway Timeout: a slow export endpoint behind a 60-second proxy timeout is a hands-on troubleshooting drill. Match the proxy timeout with how long the upstream actually takes, and fix long requests properly. Network Services And Operations needs to be checked by narrowing...ReviewedNetworkIntermediate16 minFree502 Bad Gateway: Nginx cannot connect to its upstream after an app upgrade502 Bad Gateway: Nginx cannot connect to its upstream is a hands-on troubleshooting drill. Read Nginx's upstream error to find why the proxy cannot reach the app. NGINX Network Services And Operations needs to be checked by narrowing scope, recent change, and the current live...ReviewedNetworkBeginner14 minFreeNETWORK-001Quickly checking the network path when containers cannot communicateA network-basics incident scenario that organizes the order of checking the bridge network, iptables, port mapping, and DNS.NetworkIntermediate21 minFree