dns-networking_skill

Overview

This skill helps debug DNS resolution, network connectivity, and HTTP issues with practical commands and processes. It covers DNS queries, local overrides, port checks, traceroutes, curl diagnostics, firewall inspection, proxy testing, and TLS/certificate checks. Use it to quickly identify where network failures occur and how to verify fixes.

How this skill works

The skill provides a set of command-line patterns and small scripts that inspect name resolution, test port reachability, trace network paths, and examine HTTP and TLS handshakes. It explains how to read dig/nslookup output, force DNS resolutions via /etc/hosts or curl --resolve, probe ports with nc or /dev/tcp, run traceroute/mtr, and extract certificate details with openssl. It also lists firewall and proxy commands to confirm or change rules and environment variables.

When to use it

• A hostname fails to resolve or resolves to the wrong IP
• Connections return "refused" or time out
• HTTP requests fail without clear errors (timeouts, redirects, TLS)
• Verifying firewall or security group rules and listening services
• Testing proxy configuration and proxy-specific failures
• Checking server certificates, expiry, or SNI issues

Best practices

• Start with dig +short and multiple public resolvers (8.8.8.8, 1.1.1.1) to rule out local cache issues
• Use /etc/hosts for deterministic local testing before changing DNS records
• Probe ports with nc -zv and confirm the process with ss/lsof on the server
• Use curl -w with timing variables to isolate DNS/Connect/TLS/TTFB delays
• When diagnosing packet loss use mtr rather than a single traceroute run
• Check system clock before blaming certificates — time skew causes many TLS errors

Example use cases

• Confirm DNS propagation across several public DNS servers after an update
• Debug why an API returns connection timeouts from one datacenter but not another using traceroute and mtr
• Validate that a web service is listening and certificates are valid after deployment using nc and openssl s_client
• Test and compare requests through a corporate proxy vs direct connection using curl -x and httpbin.org/ip
• Temporarily map a domain to a new server via /etc/hosts to test migration without changing public DNS