# Demonstration: Walking the Complete Path, Layer by Layer

## OBSERVE

```
$ getent hosts lab-internal.test
10.99.99.42  lab-internal.test
```

DNS: succeeded.

## HYPOTHESIS

Predict: if the next step (TCP connection) fails, what would that specific error look like?

## INSPECT

```
$ curl http://lab-internal.test:9091/
curl: (7) Failed to connect to lab-internal.test port 9091: Connection refused
```

"Connection refused" — DNS already succeeded (ruled out), the failure is specifically that
nothing is listening on port 9091 at that address.

## CHANGE

Find what IS actually listening, on the correct address:

```
$ ss -lnt | grep LISTEN
LISTEN 0 5 0.0.0.0:9095 0.0.0.0:*
```

The real service is on 9095, not 9091 — a configuration/expectation mismatch, not a DNS or
routing problem.

## VERIFY

```
$ curl http://lab-internal.test:9095/
app running
```

The full path, once pointed at the CORRECT layer that was actually broken (the port, not DNS),
succeeds end to end.

## Instructor Notes

**Demo goal:** Show that a real, plausible-sounding complaint ("DNS must be broken") is
disproven by evidence in seconds, and the REAL cause is one layer downstream.

**Approximate timing:** 10 minutes live.

**Common mistake to watch for:** jumping straight to "restart everything" instead of walking
the chain layer by layer to find the SPECIFIC broken step — the whole point of this module's
Lab is resisting that shortcut.