The Troubleshooter's Toolkit
Knowing which tool tests which layer is the key to fast, systematic diagnosis. The goal is to verify each layer in order, starting from the bottom, until you find where the chain breaks.
Layer 1 — Physical: a link-detection check on the NIC tells you whether a physical connection exists at all. No link means the problem is the cable, the switch port, or the NIC hardware — nothing above Layer 1 is worth checking yet.
Layer 2 — Data Link: inspecting the ARP cache tells you whether your machine can resolve its gateway's MAC address. If the gateway's entry is missing or marked failed, Layer 2 is broken — check VLAN configuration, switch port settings, or whether the gateway is actually up.
Layer 3 — Network: pinging an external IP tests end-to-end routing; tracing the path shows exactly which hop stops responding. If ping to an external IP fails but ping to your gateway succeeds, routing or NAT is broken downstream. If ping to the gateway itself fails, the problem is still at Layer 2.
Layer 4 — Transport: testing whether a specific TCP port accepts a connection tells you whether the application is actually listening. A timeout means a firewall is silently dropping packets; an explicit "connection refused" means the port is reachable but nothing is bound to it (application not running, or bound to the wrong interface).
Layer 7 — Application: an HTTP request against the full stack confirms everything below it is working. A 200 OK means Layer 1 through 7 are all functioning; a 5xx response means the network is fine but the application itself is failing.
The diagnostic decision tree: if you can't ping the server at all, the problem is Layer 1, 2, or 3. If ping succeeds but the port won't connect, it's a Layer 4 firewall or an application that isn't running. If the port connects but the HTTP response is a server error, it's a Layer 7 application bug. Only once every layer checks out clean do you start looking at client-side logic instead of the network.