Network Troubleshooting

We follow a structured approach: verify DNS resolution, test TCP connectivity, check routing paths (traceroute/MTR), analyze packet captures (tcpdump/Wireshark), and correlate with flow logs and firewall logs. Each layer gets tested independently — is it DNS? Routing? Firewall? MTU? Application? Most teams start guessing; we start measuring. The diagnosis methodology produces a clear root cause, not 'have you tried restarting it?'.

MTU/PMTUD issues causing packet loss for large payloads. Security group or NACL rules blocking traffic silently. DNS resolution failures due to search domain conflicts or resolver timeouts. Connection timeouts from NAT table exhaustion. Asymmetric routing causing TCP RSTs. Kubernetes service networking issues (kube-proxy, CoreDNS, CNI misconfigurations). Each of these looks like 'the network is broken' until properly diagnosed.

When logs and metrics aren't enough, we capture packets. tcpdump on relevant interfaces with targeted filters (specific source/dest, port, protocol) captures the evidence. Wireshark analysis reveals TCP retransmissions, TLS handshake failures, HTTP-level errors, and timing issues invisible to application logs. For production systems, we use minimal capture filters to avoid performance impact.

We don't just find the issue — we fix it and prevent recurrence. Fixes include firewall rule corrections, MTU adjustments, DNS configuration changes, routing table updates, or application-level timeouts. We document the root cause, the fix, and monitoring rules that detect similar issues in the future. Your team learns from the incident, and the monitoring system catches it if it happens again.