DNS & L4/L77 min read•September 2026•Kernelry Staff

Networking, DNS & Traffic Engineering Scenarios

Nearly half of all production incidents trace back to networking or DNS misconfigurations. Mastering this domain requires understanding packet flow from the browser through CDN edge locations, reverse proxies, and Kubernetes CNI overlays down to the TCP/IP stack.

Architecture Blueprint

DNS Resolution & TCP/TLS Handshake Network Path

Tracing how an application query resolves through stub resolvers, CoreDNS, and authoritative servers before establishing TCP and TLS 1.3.

Architecture Blueprint: Recursive DNS Resolution & TLS 1.3 PathNetworking • L4/L7

The Core Concept

Networks route packets from source to destination across physical routers and virtual interfaces. DNS translates domain names into IP addresses; TCP ensures data arrives reliably and in order; and TLS encrypts the communication in transit.

Key Rules of Thumb for Production Systems

•DNS caching occurs at the browser, OS stub resolver, local CoreDNS, and recursive upstream levels. Lowering TTL before a migration is mandatory.

•MTU mismatch leads to "MTU black holes" where small packets (SYN/ACK) pass, but large HTTP payload packets drop silently without ICMP Fragmentation Needed.

•TLS 1.3 reduces handshake latency to a single round trip (1-RTT) by including key exchange shares inside ClientHello.

•Keepalive connections reduce CPU overhead by avoiding repeated TCP 3-way handshakes.

Why Production Systems Demand This Depth

"It’s always DNS." When an API reports intermittent 502s or cross-region traffic experiences latency spikes, you need to systematically isolate MTU black holes, TCP window exhaustion, TLS handshake overhead, and recursive DNS resolver caching issues.

Common Diagnostic Pitfalls

•Assuming DNS changes take effect immediately after updating records (ignoring client-side caching and recursive resolver TTL adherence).
•Blaming the application when packets drop due to MTU mismatches and PMTUD (Path MTU Discovery) black holes.
•Confusing Layer 4 (TCP/UDP port level) load balancing with Layer 7 (HTTP path/header level) proxying.
•Ignoring TCP TIME_WAIT socket exhaustion when thousands of short-lived connections are created without connection pooling.

Best Practices for Scenario Drills

•Trace request journeys methodically: Client -> Local DNS cache -> Resolver -> Handshake (SYN/ACK) -> TLS -> HTTP headers -> Application.
•Know the difference between dig +trace and standard dig queries.
•Understand how ndots:5 in Kubernetes /etc/resolv.conf causes 4 redundant DNS lookups for every external domain query.

Worked Production Scenarios

Study real-world outage patterns, diagnostic trees, and clarifying questions.

Troubleshooting Intermittent HTTPS Timeouts and MTU Black Holes

Difficulty: senior

Scenario Prompt:

“Microservices communicating over a new IPSec VPN tunnel connect successfully for health checks (HTTP GET /health returns 200), but large POST requests with payloads > 1500 bytes hang indefinitely and time out. What is the root cause and how do you verify it?”

Substantive Technical Concepts to Hit:

Path MTU Discovery (PMTUD) Black Hole

IPSec tunneling encapsulates packets, adding 50-70 bytes of overhead. If the outer packet exceeds the 1500-byte MTU and intermediate routers drop ICMP "Fragmentation Needed" packets, large packets are silently blackholed.

Testing with Ping Sweep

Run ping -M do -s 1422 <destination_ip> to find the exact maximum transmission unit that passes through the tunnel without fragmentation.

TCP MSS Clamping

Apply iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu on the gateway to force clients to negotiate smaller packet segments.

Health Check Deception

Small health check packets fit inside a single 1500-byte frame and never trigger fragmentation, explaining why health checks pass while data requests fail.

Senior Clarifying Questions to Investigate:

Are ICMP Type 3 Code 4 (Destination Unreachable / Fragmentation Needed) packets being blocked by a security group or firewall?
Is the issue strictly limited to payloads larger than ~1400 bytes?
Do we control the gateway routers to apply TCP MSS clamping?

Kubernetes CoreDNS Latency Spikes and ndots:5 Exhaustion

Difficulty: senior

Scenario Prompt:

“A high-throughput API gateway deployed on Kubernetes starts reporting 5-second P99 latency spikes during traffic bursts. CoreDNS logs show severe CPU throttling and packet drops. What configuration default causes this and how do you remediate it?”

Substantive Technical Concepts to Hit:

ndots:5 Default Behavior

Kubernetes injects ndots:5 into /etc/resolv.conf. Any domain with fewer than 5 dots (e.g. api.stripe.com) triggers sequential lookups across all search domains (.svc.cluster.local, etc.) before querying the public domain.

Fully Qualified Domain Names (FQDN)

Appending a trailing dot to external URLs (api.stripe.com.) prevents the resolver from appending cluster search domains and immediately queries upstream resolvers.

NodeLocal DNSCache

Deploying NodeLocal DNSCache runs a DNS caching agent on every worker node, converting cluster-wide UDP DNS flood into localized loopback queries.

CoreDNS Autoscaling

Use cluster-proportional-autoscaler to scale CoreDNS replicas dynamically based on the total number of nodes and cores in the cluster.

Senior Clarifying Questions to Investigate:

Are the DNS queries primarily targeting external SaaS endpoints or internal cluster services?
Is NodeLocal DNSCache enabled on the cluster worker nodes?
What is the ratio of CoreDNS pods to total cluster worker nodes and client workloads?

Interactive Scenario Drills

That's where we come in.

Explaining architectural trade-offs under time constraints is very different from reading about them.

Kernelry helps you rehearse technical questions, evidence-led debugging, safe next steps, and the clear communication teams expect. The drills adapt to your answer, so you practice the reasoning rather than memorize a company-specific script. During early access, free accounts include ten daily scenarios across our mixed question pool, with no credit card required.

Start Today's Free Drill

Back to All Blog Posts