Search the library

On Linux, `ss -lntup` lists listening sockets; `netstat` may be available via net-tools on older systems. Confirm the process, address, and network namespace. A service bound only to 127.0.0.1 is not externally reachable; also check container port mapping and host policy.

It narrows the investigation but does not identify one root cause: route failure, filtering, destination outage, asymmetric routing, or capture at the wrong interface can all look similar. Capture at both ends, check socket listeners and network policy, and correlate with route and firewall telemetry.

Use the system resolver path, for example getent hosts, and compare with a direct DNS query. If a correct address resolves but the connection fails, investigate route, listener, firewall, or protocol behavior. Run diagnostics inside the same container or namespace as the application because resolver configuration may differ.