The Failure Alphabet

Almost every "A can't reach B" ticket is one of five failure signatures. Name the signature and you've named the mechanism, the usual culprit, what it rules out, and which tool to reach for next. This is the alphabet the rest of the course is written in — learn it cold.

The two you'll meet most: refused vs timeout

Both mean "curl couldn't connect." Underneath they are opposites. Run them:

curl -v http://127.0.0.1:9999/          # nothing is listening there

*   Trying 127.0.0.1:9999...
* connect to 127.0.0.1 port 9999 failed: Connection refused
curl: (7) Failed to connect to 127.0.0.1 port 9999

curl -v --connect-timeout 3 http://10.255.255.1/   # a black hole

*   Trying 10.255.255.1:80...
* ipv4 connect timeout after 3000ms, move on!
curl: (28) Failed to connect to 10.255.255.1 port 80

Same goal, two different worlds — and you already know why from the last lesson:

refused — exit (7)

An RST came back. The host is up, the packet arrived, nothing is listening. This rules out the network path and the firewall. Culprit: service down, or wrong port. Next: ss -tlnp on the target.

timeout — exit (28)

Silence — no reply at all. The packet was dropped: firewall, routing, or a dead host. This rules out "actively refused". Next: is the host even up? is a firewall dropping it?

The full alphabet

The curl exit code names three of these on sight:

curl: (6)

Couldn't resolve host — resolves-wrong (a DNS problem, deep-dived in Unit 3).

curl: (7)

Couldn't connect — refused (an RST came back from a closed port).

curl: (28)

Timed out — timeout (silence; the packet was dropped on the way).

Keep it on your desk: Failure Alphabet reference. Then drill it in the app once /author-bank has built Unit 2's questions — symptom → mechanism → rules-out → next tool is exactly what the Bank grades.