Ping Works, but HTTPS Doesn't: How to Find What Actually Broke

说明与用途

Ping 成功并不意味着 HTTPS 可用。逐层检查网络（ICMP、DNS、TCP、TLS、HTTP）可快速定位故障点。

问题

A successful ping does not guarantee that HTTPS traffic will work, leading to misdiagnosis of network issues.

结果

By testing each network layer separately, the first point of failure is isolated, reducing troubleshooting time and avoiding false assumptions based on ping success.

工作流

• 1. Verify ICMP connectivity with ping.
• 2. Check DNS resolution using dig or getent.
• 3. Test TCP connectivity to port 443 with nc -vz or curl -v.
• 4. Inspect TLS handshake with openssl s_client or curl -v.
• 5. Verify HTTP response with curl -v.
• 6. Test proxy paths with curl --noproxy and environment variables.
• 7. Check for Path MTU issues with traceroute or mtr.
• 8. Use Network Doctor (netdoc) to automate the steps and summarize results.

证据

Ping normally uses ICMP echo requests and replies.

A successful ICMP echo doesn't prove all of those layers work.

You can test it directly: nc -vz example.com 443

openssl s_client -connect example.com:443 -servername example.com

netdoc example.com

来源