DNS and Routing
67 incident problems about DNS and Routing. Start with the reviewed ones.
Read first
When DNS changed but some clients still hit the old backendAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when the DNS record is updated but resolver cache, HTTP/2 keepalive, or client pools hold on to the old target.Network3 min readWhen firewalld looks open but connections keep getting blockedAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when a port rule appears to exist but the connection fails because of zone, runtime/permanent drift, source binding, or an upstream firewall.Network3 min readHow to separate timeout and connection refused by network pathAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when DNS, route, firewall, proxy, and listener states all look like the same connection failure.Network3 min read
Recommended problems
Reviewed problems first, then problems with detailed scenarios.
NETWORK-003Capturing HTTP traffic with tcpdump and reading the request flowAn introductory problem for figuring out where request and response break down from packet-capture results.ReviewedNetworkBeginner17 minFreeNETWORK-004DNS resolves on the host but not inside the containerA typical failure that appears when the container runtime's DNS settings and search domains diverge.ReviewedNetworkBeginner16 minFreeNETWORK-009An SNI routing problem where the TLS handshake fails only on certain domainsA situation where the certificate is valid but SNI routing is wrong, so only some domains fail.ReviewedNetworkAdvanced24 minProNETWORK-020The CDN cache is fine, but a TLS version difference with the origin fails only miss requestsA situation where most requests are cache hits and look fine, but origin communication breaks only in the cache-miss segment.ReviewedNetworkIntermediate24 minProNETWORK-027Resolver search suffix turns short name into wrong destinationResolver search suffix turns short name into wrong destination is a hands-on troubleshooting drill. A short hostname works in one environment and points somewhere else in another because search suffix order changed. DNS and Routing needs to be checked by narrowing scope, recen...ReviewedNetworkBeginner13 minFreeNETWORK-041OSPF neighbors stay in EXSTARTBoth routers can ping each other, but adjacency never reaches full because one side advertises a different interface MTU on the same link.ReviewedNetworkIntermediate21 minFree
All problems (67)
NETWORK-041OSPF neighbors stay in EXSTARTBoth routers can ping each other, but adjacency never reaches full because one side advertises a different interface MTU on the same link.ReviewedNetworkIntermediate21 minFreeNETWORK-027Resolver search suffix turns short name into wrong destinationResolver search suffix turns short name into wrong destination is a hands-on troubleshooting drill. A short hostname works in one environment and points somewhere else in another because search suffix order changed. DNS and Routing needs to be checked by narrowing scope, recen...ReviewedNetworkBeginner13 minFreeNETWORK-004DNS resolves on the host but not inside the containerA typical failure that appears when the container runtime's DNS settings and search domains diverge.ReviewedNetworkBeginner16 minFreeNETWORK-003Capturing HTTP traffic with tcpdump and reading the request flowAn introductory problem for figuring out where request and response break down from packet-capture results.ReviewedNetworkBeginner17 minFreeNETWORK-1613A DNS server is reachable and one zone still failsOne zone still fails after changing a DNS forwarder.ReviewedNetworkBeginner6 minFreeNETWORK-1626A DNS failover rule is ready and one check still failsOne DNS failover probe still fails after an endpoint move.ReviewedNetworkBeginner7 minFreeNETWORK-001Quickly checking the network path when containers cannot communicateA network-basics incident scenario that organizes the order of checking the bridge network, iptables, port mapping, and DNS.NetworkIntermediate21 minFreeNETWORK-017Internal DNS search-domain order attaches to a different service with the same nameInternal DNS search-domain order attaches to a different service with the... is a hands-on troubleshooting drill. Covers a search-domain setting problem where a short-name call resolves to a different service than intended. DNS and Routing needs to be checked by narrowing scop...NetworkBeginner15 minFreeNETWORK-014The port is open but a reverse path filter keeps the response from returningA situation where incoming connections are visible but response packets are blocked by kernel policy, so the session never establishes.NetworkBeginner18 minFreeNETWORK-037Internal clients cannot reach the public VIPExternal users can access the service normally, but inside clients fail when they resolve the same public name because the edge path does not support loopback NAT.NetworkIntermediate20 minFreeNETWORK-051OSPF passive-interface default suppresses the new transit VLAN neighborThe router has the right addressing and can ping the far side, but adjacency never forms because the new transit interface still inherits passive mode.NetworkIntermediate20 minFreeNETWORK-055DHCP relay helper is configured but the reply is blocked on the return ACLThe client broadcast is forwarded correctly, yet lease assignment still fails because the routed reply path is filtered differently on the way back.NetworkBeginner17 minFreeNETWORK-1617A traceroute reaches the edge and one application still failsA path check looks fine but the app still fails behind a proxy move.NetworkBeginner8 minFreeNETWORK-1755A DNS failover record is ready and one check still failsA DNS failover check still fails after an endpoint change.NetworkBeginner7 minFreeNETWORK-1775A DNS failover record is ready and one check still failsA DNS failover check still fails after an endpoint change.NetworkBeginner7 minFreeNETWORK-1795A DNS failover record is ready and one check still failsA DNS failover check still fails after the endpoint change.NetworkBeginner7 minFreeNETWORK-1815A DNS failover record is ready and one check still failsA DNS failover check still fails after the endpoint change.NetworkBeginner7 minFreeNETWORK-1785A DNS failover record is ready and one probe still failsA DNS failover probe still fails after an endpoint change.NetworkBeginner7 minFreeNETWORK-1805A DNS failover record is ready and one probe still failsA DNS failover probe still fails after the endpoint change.NetworkBeginner7 minFreeNETWORK-1825A DNS failover record is ready and one probe still failsA DNS failover probe still fails after the endpoint change.NetworkBeginner7 minFree