Path MTU discovery

Find PMTU drop hop; ping -M do forbids frag to pinpoint blackhole MTU

tracepath -n <host>; ping -M do -s 1472 -c2 <host>
tool
troubleshooting32 commands
tags
troubleshootingnetworkdnsdebug

More troubleshooting commands

  • Confirm egress route and ARP
    ip route get <ip>; ip neigh show | grep -E 'FAILED|INCOMPLETE'

    Show actual src/iface for a dest; FAILED neigh entries = L2/ARP problem

  • TCP port reachability past firewall
    traceroute -T -p 443 <host>; nc -zv <host> 443

    TCP-SYN traceroute survives ICMP filtering; nc -zv confirms open port

  • Bypass DNS with curl --resolve
    curl -sv --resolve <host>:443:<ip> https://<host>/healthz

    Pin host to a specific IP to test backend while keeping SNI/Host header

  • In-cluster DNS smoke test
    kubectl run dnsutils --image=tutum/dnsutils -it --rm --restart=Never -- nslookup kubernetes.default

    Throwaway pod to resolve in-cluster names; verifies CoreDNS + kube-dns svc

  • Query CoreDNS directly
    dig +short @$(kubectl -n kube-system get svc kube-dns -o jsonpath='{.spec.clusterIP}') <name>.<ns>.svc.cluster.local

    Hit CoreDNS clusterIP straight; note: ndots:5 makes short names spam queries

all 32 troubleshooting commands