Part 7

Network work without guessing: diagnose one layer at a time

The terminal is particularly good at network diagnosis because each layer can be inspected directly. The goal is not to memorize networking theory; it is to know which question to ask next when a request fails.

A website request is a stack of smaller questions

Before a browser shows a page, a hostname must resolve, an address must be reachable through the relevant service, TLS may need to establish trust, and HTTP must return a response. A failure at one layer can look similar to a failure at another if you only see the final browser error.

Terminal tools let you split the stack. Ask about DNS, then the port, then TLS, then HTTP. Each successful layer removes a whole class of guesses.

Names are not addresses

dns asks how a hostname maps through DNS records. ip inspects an address or network mathematically and can also inspect the current visitor or server address. The documentation-range address 192.0.2.10/24 is useful for learning prefix, mask and range output without depending on a live service.

If DNS returns an address, that proves name resolution worked; it does not prove a web server is listening there. Keep those conclusions separate.

install ping dns ip tcp curl cert net geo

dns example.com -a -aaaa

ip 192.0.2.10/24

ip server

In lil-terminal, `ping` is an HTTP reachability check

Traditional operating-system ping usually means ICMP echo. lil deliberately uses ping for a hosting-friendly HTTP check: status, final URL, timing and resolved addresses. That distinction matters when you compare results with Linux, macOS or Windows tools.

Use -t when the practical question is “does the HTTP endpoint answer, where did it end up, and how long did it take?”. Use -i when you want the resolved IPv4/IPv6 picture.

ping https://example.com -t

ping example.com -i

A reachable address still needs the right service and trust

tcp example.com 443 -tls -i tests whether a TLS service can be opened on port 443 and shows connection/certificate details. cert -h example.com focuses on the remote certificate itself. Port 80 is a separate service question.

Do not reach for -k as a fix. Insecure TLS modes are diagnostic exceptions that disable verification; they are useful for proving that certificate verification is the failing layer, not for making an unsafe connection normal.

tcp example.com 443 -tls -i

cert -h example.com

tcp example.com 80

HTTP headers often explain what the browser hides

curl -I shows response headers without downloading the body. -i includes headers with the body, and an explicit timeout makes the experiment bounded. Saving a response on the host can be useful when you want to compare or inspect it with other tools.

Redirects, content types, cache headers and server responses often become obvious once you read the protocol instead of only the rendered page.

curl https://example.com -I

curl https://example.com -i -t 10

curl https://example.com -o network-example.html

Local interfaces and GeoIP are context, not proof

net describes interfaces visible to the PHP environment. geo can add provider-based location/network context for an IP when that capability is available. GeoIP data is approximate and may be unavailable or differ by provider.

Use these tools as context for diagnosis, never as a source of identity. An IP location is a network estimate, not a statement about a person.

net -l

net -4

geo example.com -c

Write down the layer-by-layer check that worked

When you diagnose the same host repeatedly, save the successful sequence: HTTP reachability, DNS, TLS port, headers and certificate. On another server you can run exactly the same questions and compare outputs instead of reconstructing your troubleshooting process.

This is a good example of why scripts preserve knowledge. The script does not “repair the network”; it preserves a disciplined way of observing it.

Keep this as a script

Save this as network-check.lil. It performs five read-only checks against example.com, each at a different layer. Replace the hostname only when you deliberately want to diagnose another service.

#lil
@install ping dns tcp curl cert
ping https://example.com -t
dns example.com -a -aaaa
tcp example.com 443 -tls
curl https://example.com -I
cert -h example.com