# Demonstration: The Same Five Questions, Answered Live

## OBSERVE

```
$ ip -4 addr show eth0
inet 172.17.0.2/16 ...
```

"What address do I have?" — answered.

## HYPOTHESIS

Predict what `ip route` will show before running it — specifically, predict whether there will
be a `default` line.

## INSPECT

```
$ ip route
default via 172.17.0.1 dev eth0
172.17.0.0/16 dev eth0 ...
```

Confirmed — a `default` route exists, meaning traffic to anywhere outside `172.17.0.0/16` has
somewhere to go.

## CHANGE

```
$ ss -lnt
LISTEN 0 511 0.0.0.0:80 0.0.0.0:*
```

"What's listening?" — port 80, confirmed.

## VERIFY

```
$ curl -sf http://localhost/ -o /dev/null -w '%{http_code}\n'
200
```

The full chain, verified end to end with real evidence at each layer — not "the network seems
fine," but five specific, falsifiable answers.

## Instructor Notes

**Demo goal:** Chain all five commands together as ONE continuous diagnostic narrative, not
five disconnected syntax examples.

**Approximate timing:** 8 minutes live.

**Common mistake to watch for:** running `curl` first and stopping at "it worked" without ever
having separately confirmed address/route/port — fine when things work, but the WRONG habit for
when they don't (Module 5's Lab requires the full sequence).