curl -v is your best friend
Verbose mode shows the sequence interviewers care about:
- DNS resolution — which IP was chosen
- TCP connect — handshake to port
- TLS handshake — cert details, protocol version
- HTTP request/response — status, headers, body
-I sends HEAD (headers only). --resolve forces an IP for a hostname (test specific backend). --connect-timeout separates "DNS works, TCP doesn't" from slow servers.
dig proves DNS
dig example.com — answer section, TTL, which resolver answered.
dig +trace — walk root → TLD → authoritative. Use in incidents to separate DNS misconfiguration from app down.
traceroute (awareness, not mastery)
Shows hops and per-hop latency. ICMP rate-limiting on middle boxes makes output lie — know the tool's purpose (where delay enters) not every anomaly.
When packet capture matters
Escalate to Wireshark/tcpdump when you need proof of retransmits, RSTs, or TLS alert bytes — rare in interviews, common on the job. For prep: know it exists; don't budget hours unless you enjoy it.
Mapping symptoms → tool
| Symptom | First tool |
|---|---|
| "Can't resolve host" | dig |
| "Connection refused / timeout" | curl -v, check port/firewall |
| "SSL certificate problem" | openssl s_client, cert dates/SAN |
| "Slow first byte" | curl -w timing breakdown |
| "Stale content after deploy" | dig TTL + cache headers |
Further Reading
Hands-On Tasks (Optional)
Low-setup exercises you can run locally or on a free-tier cloud account. No autograding — the goal is to build intuition, not pass a test.
- Break down latency with curl15m
Run `curl -w '@-' -o /dev/null -s https://example.com <<'EOF' dns:%{time_namelookup} connect:%{time_connect} tls:%{time_appconnect} ttfb:%{time_starttransfer} total:%{time_total} EOF`. Match each phase to a layer from Topic 1.