firstp1ck/pi-coding-agent-forge/network-diagnostics

# Check internet connectivity
ping -c 3 1.1.1.1
 
# Check DNS resolution
dig google.com +short
 
# Check a local service
curl -s -o /dev/null -w "%{http_code}" http://pi.hole/admin/

# Resolve via system DNS (Pi-hole)
dig example.com +short
 
# Resolve via specific DNS server
dig @1.1.1.1 example.com +short   # Cloudflare
dig @8.8.8.8 example.com +short   # Google
dig @pi.hole example.com +short   # Pi-hole
 
# Reverse DNS lookup
dig -x <ip-address> +short
 
# Full DNS trace
dig example.com +trace

# Check if Pi-hole is blocking correctly
# Query a known ad domain — should return 0.0.0.0 or NXDOMAIN
dig @pi.hole ads.google.com +short
 
# Check Pi-hole query log (recent queries via API)
curl -s "http://pi.hole/admin/api.php?getAllQueries=100" | jq '.data | length'
 
# Check upstream DNS health
curl -s "http://pi.hole/admin/api.php?getForwardDestinations" | jq '.'
 
# Check if Pi-hole is enabled
curl -s "http://pi.hole/admin/api.php?status" | jq '.status'

DNS not resolving?
├── Can you ping 1.1.1.1?
│   ├── No → Network/routing issue (not DNS)
│   └── Yes → DNS issue confirmed
│       ├── Does dig @1.1.1.1 work?
│       │   ├── No → Upstream DNS blocked (firewall?)
│       │   └── Yes → Local DNS problem
│       │       ├── Does dig @pi.hole work?
│       │       │   ├── No → Pi-hole issue
│       │       │   │   ├── Is pihole-FTL running?
│       │       │   │   ├── Is port 53 listening?
│       │       │   │   └── Check Pi-hole logs
│       │       │   └── Yes → Client DNS config issue
│       │       │       └── Check /etc/resolv.conf
│       │       └── Is /etc/resolv.conf pointing to Pi-hole?

# Layer 1-2: Physical/Link
ip link show              # Interface status
ethtool <interface>       # Link speed, duplex
 
# Layer 3: Network
ip addr show              # IP addresses
ip route show             # Routing table
ping -c 3 <gateway>      # Gateway reachable?
ping -c 3 1.1.1.1        # Internet reachable?
 
# Layer 4: Transport
ss -tlnp                  # Listening TCP ports
ss -ulnp                  # Listening UDP ports
 
# Layer 7: Application
curl -v http://example.com  # HTTP connectivity

# Standard traceroute
traceroute <host>
 
# TCP traceroute (bypasses ICMP blocks)
traceroute -T -p 443 <host>
 
# MTR for continuous monitoring
mtr --report <host>

# From this machine to a target
nc -zv <host> <port>           # Netcat
timeout 3 bash -c "echo > /dev/tcp/<host>/<port>" && echo "open" || echo "closed"
 
# Check multiple ports
for port in 22 53 80 443 3000 8080 11434; do
  nc -zv <host> $port 2>&1 | grep -E "succeeded|refused"
done

# Quick scan of a host
nmap -F <host>
 
# Scan specific ports
nmap -p 22,53,80,443,3000,8080,11434 <host>
 
# Scan entire local subnet
nmap -sn <local-subnet-cidr>    # Ping sweep (who's online?)

Internet
  │
  ▼
[Router/Gateway]
  │
  ├── Pi-hole (DNS) ─── pi.hole:53, :80
  │
  ├── <gitea-or-nas-host> ─── Gitea :3000, NAS SSH :<ssh-port>
  │
  ├── <ssh-host> ─── SSH server :22
  │
  ├── <ollama-host> ─── Ollama :11434
  │
  └── [This machine] ── Workstation

# ARP table (devices recently seen)
ip neigh show
 
# Ping sweep
nmap -sn <local-subnet-cidr>
 
# Check DHCP leases (if accessible)
# Often at router admin page

# What's my public IP?
curl -s ifconfig.me
 
# What's my local IP?
ip -4 addr show | grep -oP '(?<=inet\s)\d+(\.\d+){3}' | grep -v 127.0.0.1
 
# Check if a domain is blocked by Pi-hole
dig @pi.hole <domain> +short  # 0.0.0.0 = blocked
 
# DNS response time
time dig google.com @pi.hole > /dev/null
 
# Check all network interfaces
ip -br link show