references/network-diagnostics.md

# Connectivity and traffic flow

Trace: client resolution / DNS caching → routing/NAT → firewall/security group → gateway/LB → TLS/SNI → path/host rules → Kubernetes service/EndpointSlices → pod app → upstream dependencies.

Observe failure at layer: DNS (NXDOMAIN, split horizon), TCP (timeout/refused), TLS (cert chain/host/expiry), HTTP (404/503/502/429), application (exceptions, latency), cloud quota. Verify certificates and load balancer health. Compare working vs broken zone/region/identity and request IDs. Avoid "allow all" or disabling TLS in production.

Give minimal diagnostic commands with environment placeholders and safe exposure labels. Never claim a synthetic external probe was run.