# Knowledge Check: Linux Network Inspection

---

**1. Which command answers "what TCP ports are listening on this machine"?**

*Answer:* `ss -lnt`.

---

**2. Which command answers "where will this machine send traffic that isn't local"?**

*Answer:* `ip route` — specifically, the `default` line in its output.

---

**3. Why is `curl` the only tool in this module that can confirm the APPLICATION itself is
working, not just the network path to it?**

*Answer:* Address, route, port, and DNS can all be perfectly correct while the application
behind them still returns an error or wrong content — `curl` is the only one of these tools that
actually completes an HTTP request and inspects the real response.

---

**4. `getent hosts` and `dig` both resolve names. When would you reach for `dig` specifically
instead of `getent hosts`?**

*Answer:* When you specifically suspect a DNS server issue and want to query DNS directly with
more detail — `getent hosts` checks the same path the rest of the system uses (including local
`/etc/hosts` overrides first), which is usually the right first choice, but doesn't show you as
much about what the actual DNS server itself said.

## Instructor Notes

**Facilitation:** Question 3 reinforces Module 3's "layers can each independently succeed or
fail" idea with a very concrete example.

**Approximate timing:** 5 minutes.