Seven parts on finding out why the network is broken, plus an on-ramp, in the order I would teach it. Each part stands alone, but they build: the mental model in Part 1 is the map everything after it refers to. About two hours end to end.

Part 0 is the on-ramp - skip it if you are comfortable with dig and nc. If you are here mid-incident, go straight to the cheat sheet.

0 Part 0: The Fundamentals (start here) Addresses, routes, ports, DNS and what actually happens when a packet leaves your box. Start here if the vocabulary is shaky. 1 Part 1: The Mental Model The seven-stop path from wire to application. Every later part plugs into this map. 2 Part 2: Reading Sockets with ss Who is connected, from where, in what state - and what Recv-Q and Send-Q are really telling you. 3 Part 3: Proving Packet Loss Interface counters, netstat -s and the difference between "the network is dropping traffic" and proving it. 4 Part 4: Reading tcpdump Capture filters that do not lie, and reading a handshake, a retransmit and a reset off the wire. 5 Part 5: Latency, Queues, and a Real nginx Hunt Where latency hides, which queue it is sitting in, and a slow-nginx investigation end to end. 6 Part 6: Routing, ARP, Firewalls and Containers Why the packet went out the wrong interface, and what Docker did to your routing table. 7 Part 7: The Cheat Sheet Every command from the series on one page, grouped by the question you are trying to answer.