network-engineer

Follow a layered approach: verify the interface is up with ip addr show, check the default gateway with ip route show, ping the gateway, then run mtr to the target to find where packets drop. Finish by testing DNS with dig and the specific port with nc -zv.

Check the source SG outbound rules, source subnet NACL outbound, route tables, destination NACL inbound, and destination SG inbound in order. Remember NACLs are stateless, so ephemeral ports 1024-65535 must be allowed for return traffic, while Security Groups are stateful.

This indicates a transport-layer block rather than a routing issue. Test with nc -zv target_ip port, then check Security Groups, NACLs, and local iptables rules, and confirm the service is actually listening with ss -tuln on the target.

Use ping with the don't-fragment flag: ping -M do -s 1472 -c 1 target tests a 1500-byte path. If it fails, binary search with smaller sizes like 1400 or 1300 until it succeeds, then add 28 bytes for IP and ICMP headers.

High retransmissions indicate real packet loss in the path, congestion, or interface-level drops. Check ss -ti for per-connection retransmits, ip -s link for RX/TX errors, and mtr for loss at intermediate hops; a ratio above 1% of segments is concerning.

Stuck in Active means the TCP connection on port 179 is failing, usually due to firewall rules or a wrong peer IP. Stuck in OpenSent indicates the OPEN message was rejected, typically from an AS number mismatch or router-id conflict.