Network Debug Toolkit
Four tools L3 network engineers reach for during real tickets — packet path tracing, BGP best-path, tunnel MTU/MSS, and config diff. Everything runs in your browser. Nothing leaves your machine.
URL Diagnose L3 troubleshooter
Paste the exact URL you're trying to reach. The tool runs DNS → HTTPS → redirect-chase → header inspection from a Cloudflare Worker and tells you what's actually wrong — Cloudflare 5xx, SSO gate, 404, WAF block, origin down — plus the one-line fix.
Redirect chain & headers
▶ Raw response (JSON)
AI Analyze Llama 3.3 70B via Cloudflare Workers AI
Upload any file — log, config, error trace, JSON, YAML, certificate, curl -v output,
stack trace, network device config. The AI auto-detects the kind, redacts secrets,
and returns a root-cause + numbered fix list. Useful when you have the symptom but not the cause.
▶ …or paste content directly
api_key=, password=, Bearer, JWTs, AWS keys, PEM private keys, session cookies) are redacted before
the AI sees them. Nothing is stored. Don't upload anything you wouldn't paste into a vendor support ticket.
▶ Raw AI response (JSON)
Online Probes live, runs from Cloudflare
DNS lookup, HTTP reachability, TCP port check, WHOIS/ASN — all egress from Cloudflare's edge IPs, not your machine. Use these to triage real connectivity issues without exposing your home / lab IP to the target.
🔍 DNS Lookup (nslookup)
via 1.1.1.1 DoH🌐 HTTP Ping (reachability + latency)
fetch from CF edge🔌 TCP Port Check (telnet-style)
Workers connect() · banner grabCommon ports: 22 (SSH), 25 (SMTP), 53 (DNS), 80 (HTTP), 443 (HTTPS), 3306 (MySQL), 3389 (RDP), 6443 (k8s)…
📡 ICMP Ping
relay: checking…Ping leaves a relay VM, not your machine. Source IP rotates across relays.
🛣️ Traceroute
relay: checking…Up to 20 hops. Trace originates from the relay's network — useful for seeing the path from a 3rd-party perspective.
📇 WHOIS / RDAP / ASN
rdap.org + Team Cymru▶ Why these probes are safe (the privacy story)
When you "ping example.com" from your laptop, that target's logs see your public IP. If you're at home or in a small office, that's your residential IP — which exposes your physical location, ISP, and household. For pentest or recon work this is also operationally bad.
These probes run inside a Cloudflare Worker. Your browser tells Cloudflare what to look up, and Cloudflare's edge IP does the actual DNS / HTTP / TCP / WHOIS query. The target sees a Cloudflare edge IP (1xx.xxx.xxx.xxx range), not yours. We do not log what targets you query.
What's still visible to Cloudflare itself: the target hostname (in the Worker request URL). This is fine for the recon-only / "is my service up" use case but isn't end-to-end anonymous.
Packet Path Tracer
Define your topology (routers and firewalls with routes, ACLs, NAT). Define a packet (src, dst, port, protocol). The tool walks the packet device-by-device and shows where it gets forwarded, NAT-translated, or dropped — and which rule caused it.
1. Topology (JSON)
Array of devices. Each device has name, interfaces (with IPs), routes, optional acls and nat.
2. Packet
3. Trace Result
▶ Quick reference — topology JSON schema
[
{
"name": "R1",
"interfaces": [
{ "name": "eth0", "ip": "10.10.10.1/24" },
{ "name": "eth1", "ip": "172.16.0.1/30" }
],
"routes": [
{ "dst": "10.10.10.0/24", "nexthop": "connected", "egress": "eth0" },
{ "dst": "0.0.0.0/0", "nexthop": "172.16.0.2", "egress": "eth1", "to_device": "FW1" }
],
"acls": [
{ "dir": "in", "iface": "eth0", "action": "permit", "match": { "src": "10.10.10.0/24" } },
{ "dir": "out", "iface": "eth1", "action": "permit", "match": "any" }
],
"nat": [
{ "type": "source", "match": { "src": "10.10.10.0/24" }, "translate_src_to": "203.0.113.10" }
]
}
]
Rule evaluation order at each device: ingress ACL → route lookup (longest prefix match) → NAT → egress ACL → handoff to to_device (or terminate).
BGP Best-Path Simulator
Paste route entries learned for the same prefix from multiple BGP peers. Tool runs Cisco's 13-step best-path algorithm and shows which route wins — and which step eliminated each loser. The exact mental model you need for PCNSE / CCNP / CCIE / JNCIS-SP / route-policy work.
Route entries
| Route | Next-hop | Weight | Local-Pref | AS-Path | Origin | MED | Peer-Type | IGP-Cost | Router-ID | Peer-IP |
|---|
Result
▶ Best-path algorithm reference (Cisco order)
- Prefer route with highest Weight (Cisco-local).
- Prefer route with highest Local Preference (default 100).
- Prefer locally originated (network/redistribute/aggregate).
- Prefer shortest AS-Path.
- Prefer lowest origin type: IGP < EGP < Incomplete.
- Prefer lowest MED (only if from same AS, unless always-compare-med).
- Prefer eBGP over iBGP.
- Prefer lowest IGP metric to next-hop.
- (Multipath check — out of scope for this tool.)
- Prefer oldest eBGP route (stability, optional).
- Prefer lowest Router-ID (or originator-id for reflected).
- Prefer shortest cluster-list.
- Prefer lowest neighbor IP.
MTU / MSS Overhead Calculator
Add encapsulation layers in the order the packet sees them (innermost first). Tool computes the effective payload MTU and the exact MSS clamp value to set on your firewall / SD-WAN edge. Solves the #1 "VPN works but apps hang" ticket.
Path layers
Result
▶ Why this matters (and where it breaks in production)
Most VPN tickets that look like "site-to-site comes up, ping works, large transfers hang" are PMTUD black-hole problems. ICMP "fragmentation needed" is dropped by a transit firewall, sender never learns the path MTU, and TCP retransmits forever. The fix is almost never raising MTU — it's clamping MSS at the tunnel ingress so TCP segments are pre-sized for the encapsulated path.
Rule of thumb: MSS = effective MTU − 40 (IPv4 + TCP headers), minus any TCP options you use (timestamps, SACK).
On PAN-OS: Network → Interfaces → Advanced → Adjust TCP MSS. On IOS: ip tcp adjust-mss <value> on the tunnel interface. On Linux: iptables -t mangle -A FORWARD ... TCPMSS --clamp-mss-to-pmtu.
Config Semantic Diff
Paste two firewall / router configs. Tool normalises (strips comments, sorts within sections, ignores whitespace), then produces a side-by-side diff with category highlighting (interfaces, ACLs, NAT, BGP, OSPF, security rules). Pre-change reviews, post-incident forensics, and "what did the night-shift change" investigations get 10x faster.