Exercise 2: Path Is Clean, But the Application Still Can't Connect — Possible Solution ==================================================================== Next tool: ss (or netstat). Explanation: Per the chapter's own workflow section, the recommended order is "ping first... traceroute next... ss -- if this is the local machine, is the expected service even listening? tcpdump last." Since traceroute has already confirmed the network path itself is healthy all the way through -- ruling out the routing-layer problems net1-6's own material covers -- the next logical question, per the chapter's own workflow, is whether the destination machine is actually LISTENING for connections on the port the application is trying to reach at all. What ss would help confirm: Per the chapter, "ss -tulpn... shows every listening port... and every active connection, including its exact TCP state." Running this on the destination server would directly answer several genuinely distinct possibilities that a clean traceroute alone says nothing about: whether the expected service (e.g. a web server, database, or API process) is actually running and bound to the correct port at all; whether it's bound only to a local/loopback address rather than the externally-reachable one; or whether connection attempts are arriving but getting stuck in a particular TCP state -- per the chapter's own reference to net1-7's own warn-box, "a connection is genuinely stuck mid-handshake," which would show up as connections sitting in a state like SYN_RECV rather than reaching ESTABLISHED. Why tcpdump isn't the next step yet: The chapter's own workflow places tcpdump explicitly last, "if everything above looks fine but something is still wrong" -- since ss hasn't been checked yet in this scenario, and it could plausibly reveal the actual cause directly (e.g. the service simply isn't listening at all), jumping straight to raw packet capture would skip over a faster, more direct diagnostic step that the workflow itself places earlier for exactly this reason. WHY THIS WORKS AS AN ANSWER ------------------------------ This follows the chapter's own explicit workflow ordering rather than guessing at a tool, and explains specifically what new information ss would surface that a clean traceroute couldn't have already ruled out.