The till in a bike shop called Vance Cycles stopped reaching its payment gateway at 09:40 on a Tuesday, and every other site on the same machine still loaded. Five layers could be lying about that, and the first command worth running is ip -br addr, because an address in 169.254 means DHCP never answered and nothing above that layer is worth testing yet.
That is the division this pillar runs on. There are seven topics here rather than one because no instrument reaches past its own layer: a multimeter cannot see a stale entry in a hosts file, and dig +short cannot see a power supply that fails under load. Picking up the right instrument is most of the work, and it is a separate skill from knowing how to use any of them.
Of the eight pillars in Knowledge has a shape, this is the one people reach mid-fault rather than mid-study, which is why the answer comes before the model on every page below it.
Five of the seven stack, and security is the same question asked at each
A request arriving at a service passes through five of these topics in a fixed order, each resting on the one below it. Cloud is on top, because it is not a new kind of machine, it is the other four rented by the hour with somebody else holding the root password. Servers sit under it: the process that answers, and the configuration file that decided how. Networking is under that, because a server nobody can reach is not down and is indistinguishable from down. Operating systems are under the network, since the packet left a kernel that owns the socket and decides who may read the file. Computers are the floor.
Security is not a sixth slab. It is that same question asked at every one of the five, asked in the knowledge that the answer might be a lie: the firewall that permits port 443 permits everything anybody has deliberately put behind port 443, and the customer list is behind port 443. A defence diagram listing only what a layer stops is an advertisement, and the column that decides how bad a breach turns out to be is the other one.
Electronics is the seventh, and it does not sit on the stack, it leaves it. A board carrying a microcontroller and no operating system is a different object with different failure modes, found with a multimeter rather than with a log.
The instruments change character as the stack goes down. At the top the instrument is the bill, read line by line, because a cloud fault is usually a fault in what somebody left running. In the middle the instrument prints text: ss -tlnp for what is listening and which user it runs as, journalctl -u nginx for what a service said about itself before it stopped. At the floor nothing prints anything and the instrument becomes substitution, where a known good power supply settles in two minutes what a week of reading logs cannot.
The command line first, and the expensive wrong order is cloud before it
The order that costs the most is starting at the top. Somebody who opens a cloud account before they can read ip route on one Linux machine is not learning cloud, they are learning one company's console, and the console is the part that changes. A route table in a virtual private cloud is a route table. A security group is a firewall rule with a different word on the button. Each of those means what it means on a single machine, and a single machine is where being wrong is free.
The other wrong order is the certificate before the machine. Security+ and CCNA are real and employers do ask for them by name, and somebody who studies either without a machine they are allowed to break comes out with the vocabulary and none of the reflexes. The vocabulary passes the exam. The reflex is what says, at 09:41 on that Tuesday, that the next move is a command rather than a reboot.
The plank people skip is the interface that scales past clicking, on the belief that it can be picked up later. It cannot be picked up later. Every topic above it hands its answer back as text, and somebody who cannot filter text reads every answer through a keyhole.
The order
Three fixed stops, then a fork that is genuinely a choice
The second stop is the one people leave until later, and it is the one that makes the other three cheap.
- ComputersOne machine you own and may reinstallThe only stop where being wrong costs nothing01
- 02Operating systemsThe command lineEvery stop after it answers in text, and text is the only thing that can be filtered
- NetworkingOne real fault, tested from the floor upA definition survives until three of them are on the table at once03
- 04The forkServers and cloud, or electronics, or securityA choice rather than an order, and the first three stops are the same whichever way it goes
There are no dates on this road, deliberately. Somebody with a fault to fix every week passes the third stop long before somebody with a syllabus.
Networking is where three facts stop being three facts
IP addresses, DNS and HTTP get learned as three separate facts, and each is straightforward on its own. The stall arrives the first time all three are on the table at once and one of them is lying. It comes with a sentence anybody who has been there recognises: the site is up, it is up from here, and the customer still cannot reach it. No definition of DNS prepares somebody for that, because the question has stopped being what DNS is and become whether this machine's answer to a name is the answer everybody else is getting.
What gets a person through it is a fixed order to test in, worked upward from the floor, where each answer clears the layers underneath it and says nothing at all about the layers above. On the till that order ran ip -br addr, ip route, ping -c 3 9.9.9.9, dig +short, getent hosts and curl -I. What turns those six into a method rather than a list is writing down, before pressing return, what each of the two possible answers will rule out. A command whose result would not change the next move is being run for comfort.
The first four answered clean. dig +short pay.vancecycles.example returned the address the payment gateway moved to in March, and getent hosts pay.vancecycles.example returned the address it had before that, from a line somebody put in the hosts file during the migration and never took out. dig asks a DNS server and getent asks the machine, which is the question the till was actually asking, and when those two disagree the machine is the one lying. working out which layer is broken is where that stops being a story and becomes the order to work in.
The order to test in
Six commands on the Vance Cycles till, worked upward from the floor
Each answer clears the layers underneath it and says nothing at all about the layers above.
- Computersip -br addrOne line per interface. 169.254 means the lease never arrived, and nothing higher is worth testing.
- Operating systemsip routeA missing default route looks exactly like a broken internet, and the local network looks perfect while it lasts.
- Networkingping -c 3 9.9.9.9Separates a dead wire from a live wire carrying nothing.
- Networkingdig +short pay.vancecycles.exampleAsks a DNS server directly, and hands back the address the rest of the world is using.
- Operating systemsgetent hosts pay.vancecycles.exampleAsks the machine, through the hosts file first, the way the till asks. Disagreement here convicts the machine.
- Serverscurl -I https://pay.vancecycles.example/The far end answers or it does not, and the status line says which of those two happened.
It leaves out time. Every step answers in a second, so a fault that only appears every twenty minutes survives all six and needs something recording while nobody is watching.
What to open in 2026
iproute2 supplies ip and ss, and it replaced net-tools, which supplied ifconfig and netstat. It is on every current Linux already and there is nothing to buy. The mistake is typing ifconfig out of habit on a fresh Debian or Fedora, getting command not found, and concluding the machine is broken when the command is simply gone.
journalctl reads the systemd journal, and it replaced tailing /var/log/messages and grepping it. Free, and already installed. The mistake is running it bare, getting every line since boot and giving up: journalctl -u nginx narrows it to one service, -b narrows it to this boot, and a question that specific usually has its answer in the first screen.
dig replaced nslookup in every piece of advice worth following, and it ships in bind9-dnsutils on Debian and bind-utils on Fedora, at no cost. The mistake is the one the till made visible: dig reports what a DNS server says, which is not always what an application on the same machine will get.
Docker replaced shipping a machine image with a page of setup instructions attached to it. The engine on Linux is free; Docker Desktop has needed a paid subscription for larger companies since 2021. The mistake is what people reach for next rather than Docker itself: Kubernetes solves the problem of many machines and many teams, and a reader with one server does not have that problem and will spend a month acquiring it.
Wireshark is what to open when every layer has answered clean and the answer still makes no sense. It has carried that name since 2006, when it was renamed from Ethereal, and it is free. The mistake is capturing on the wrong interface and reading an empty file as evidence that nothing is wrong.
AWS, Azure and Google Cloud are the three worth naming, and between them they replaced a second hand server in a cupboard and the argument about who owned it. All three publish a free tier and all three bill by the hour outside it. Set the budget alert before creating the first resource rather than after the first bill.
You stop replacing parts and start halving the space
At one month a fault produces a list of things to try. At three months it produces an order, and the order arrives with predictions attached. The check takes ten minutes and needs no equipment: take a fault you have not seen before, write down the first three commands you will run and, beside each, the two answers it can come back with and what each of them eliminates. Then run them. Being unable to write the predictions down at all means the list is a list of things that worked before, and it stops working on a fault nobody has had yet.
The second signal is harder to fake, and it is about the machine rather than about you. Two of the four questions worth asking have a command behind them: ss -tlnp for what is listening and under which user, df -h for how close the disk is to full. The other two were settled months before anybody thought to ask, by somebody deciding to keep a backup that gets restored and logs that are collected before the night in question. Not checked is a real answer with real work attached, and it is worth separating from no, because those two lead in opposite directions.
The signal
Four questions, and two of them were answered months before anybody asked
Two are settled by one line of output. The other two are settled by a habit somebody kept, or did not.
- What is listening on itThe port, the process behind it, and the user it runs as
- How close the disk is to fullOne screen, and the row that matters is rarely the one expected
- Whether the backup restoresNothing on the machine can say. Somebody has to have done it, on purpose, recently.
- Who logged in last nightOnly if the logs were being kept before last night
Remove one column and the word above it stops being true
It does not say which columns are standing on any particular machine. The usual discovery is that at least one answer is neither yes nor no, and nobody looked is a different fact from no, with different work attached.
Where to go in
The machine itself, and keeping it working is the gentlest way in, because it is the only topic where the fault is often visible: a fan that stopped, a cable seated badly, a disk that clicks. the layer between hardware and everything you run is where the return is highest, and it is the topic that makes the other six cheaper rather than the one that comes after them.
Getting data from one machine to another is the stall, so it earns the most time rather than the least. Machines that answer requests, and keeping them up and renting infrastructure instead of owning it are the same subject with different owners of the failure, and the difference that shows up in a working week is who gets billed for a mistake.
Defending systems, and understanding the attacks first is written last in this list and should not be read last, because it is made of the other six. the only real answer to ransomware, if they restore is the page inside it that decides whether a bad week stays a bad week. Circuits, boards and things that are not a computer is the branch off the stack, and the one topic here somebody can finish a project in on a kitchen table.
From outside this pillar, getting code off your machine and keeping it running is this same set of skills in the hands of the people who write the software, everything between a browser and a server is the far half of every page in networking, and choosing work, getting it, and moving up is worth reading before any certification, because a certificate answers the question the market asks rather than the one the machine asks.
What is left is which machine becomes the one you own and are allowed to break, and the answer changes what can be practised: an old laptop and a rented virtual server teach different halves of this page, and only the rented one teaches what happens when the machine is somewhere you cannot walk to. Debian, Red Hat and choosing between families is where that gets settled, and it is a smaller decision than it looks.