Networking for DevOps

# dig (Linux/Mac/WSL2) — full detail
dig google.com              # Full DNS response
dig google.com A            # A records only
dig google.com MX           # Mail server records
dig +short google.com       # Just the IP(s)
dig @8.8.8.8 google.com    # Use Google's DNS server
dig +trace google.com       # Full resolution path

# nslookup (works on all platforms)
nslookup google.com
nslookup -type=MX gmail.com
nslookup google.com 8.8.8.8  # Query specific DNS server

# Check /etc/hosts (local overrides)
cat /etc/hosts               # Linux/Mac/WSL2

# Windows PowerShell native DNS
Resolve-DnsName google.com
Resolve-DnsName google.com -Type MX
Resolve-DnsName google.com -Server 8.8.8.8

# View listening ports (Linux/Mac/WSL2)
netstat -tlnp              # TCP listening, numeric, with PIDs
ss -tlnp                   # Newer, faster alternative to netstat
lsof -i :8080              # What process is using port 8080?

# Test if a remote port is open
nc -zv github.com 443      # netcat: port 443 open?
nc -zv 10.0.0.5 5432       # DB port reachable?
curl -s --connect-timeout 3 telnet://host:22 && echo "open"

# Trace the network path
traceroute google.com      # Linux/Mac
tracepath google.com       # Alternative (no sudo)

# Windows PowerShell equivalents
netstat -an                # All connections
Test-NetConnection -ComputerName github.com -Port 443
Test-NetConnection github.com -Port 443 -InformationLevel Detailed
tracert google.com         # Windows traceroute

# Check certificate expiry date
echo | openssl s_client -connect google.com:443 -servername google.com 2>/dev/null \
  | openssl x509 -noout -dates
# notBefore=... notAfter=Dec 15 12:00:00 2025 GMT

# Full cert details (subject, issuer, SANs)
echo | openssl s_client -connect google.com:443 2>/dev/null \
  | openssl x509 -noout -text | grep -A2 "Subject:\|Not After\|DNS:"

# Quick expiry check with days remaining
domain="google.com"
expiry=$(echo | openssl s_client -connect $domain:443 -servername $domain 2>/dev/null \
  | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
echo "Expires: $expiry"

# Test TLS version + cipher
curl -v --tls-max 1.2 https://google.com 2>&1 | grep "SSL connection"

# Windows PowerShell
$req = [Net.HttpWebRequest]::Create("https://google.com")
$req.GetResponse() | Out-Null
$req.ServicePoint.Certificate.GetExpirationDateString()

upstream backend {
    least_conn;                    # Algorithm: least connections
    server 10.0.0.1:8080;         # App server 1
    server 10.0.0.2:8080;         # App server 2
    server 10.0.0.3:8080 backup;  # Backup — only if others fail
}

server {
    listen 443 ssl;
    server_name api.example.com;

    ssl_certificate     /etc/ssl/certs/server.crt;
    ssl_certificate_key /etc/ssl/private/server.key;

    location / {
        proxy_pass         http://backend;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;

        # Health check
        proxy_connect_timeout 3s;
        proxy_read_timeout    30s;
    }
}
# Health check endpoint (nginx checks this)
# If /health returns non-2xx: server removed from pool

# === DNS ===
Resolve-DnsName google.com
Resolve-DnsName google.com -Type A
Resolve-DnsName -Name google.com -Server 8.8.8.8
nslookup github.com        # works in PS too

# === HTTP ===
Invoke-WebRequest https://httpbin.org/get
(Invoke-WebRequest https://google.com).StatusCode
curl.exe -I https://httpbin.org/get   # real curl
curl.exe -o NUL -s -w "%{http_code}" https://google.com

# === Ports ===
netstat -an | Select-String "LISTEN"
Test-NetConnection -ComputerName github.com -Port 443
Test-NetConnection github.com -Port 443 -InformationLevel Detailed

# === TLS ===
$req = [Net.HttpWebRequest]::Create("https://google.com")
$req.GetResponse() | Out-Null
$req.ServicePoint.Certificate.GetExpirationDateString()

# === HTTP errors ===
200, 301, 404, 500 | ForEach-Object {
  $r = Invoke-WebRequest "https://httpbin.org/status/$_" -EA SilentlyContinue
  Write-Host "Status $_`: $($r.StatusCode)"
}

# Step 1: Verify the issue
curl -o /dev/null -s -w "%{http_code}" https://api.example.com/health
# → 502

# Step 2: Check DNS (is the domain resolving?)
dig +short api.example.com
# → 1.2.3.4 (DNS is fine)

# Step 3: Is the load balancer port open?
nc -zv api.example.com 443 && echo "LB port OPEN"
# → open (load balancer is up)

# Step 4: Is the backend app responding?
curl http://10.0.0.1:8080/health  # Direct to app server
# → curl: (7) Failed to connect — APP SERVER IS DOWN

# Step 5: Check app logs
ssh app-server-1
sudo journalctl -u myapp --since "10 min ago"
# → Out of memory! OOMKilled the process

# Step 6: Restart app, verify
sudo systemctl restart myapp
curl -o /dev/null -s -w "%{http_code}" https://api.example.com/health
# → 200 ✅