Automate the checks: a reusable connectivity script

What the script does

It runs the same bottom-up checks as the earlier labs and stops at the first failure, because everything after a failed step would fail too:

1. Is there a default gateway, and does it answer?
2. Does the name resolve?
3. Does the TCP port open?
4. If it’s port 443, does an HTTPS request succeed?

The scripts below are starting points written for this lab. Read them before running them, which is good practice with any script you find online.

Bash version (Linux)

Save this as netcheck.sh:

#!/usr/bin/env bash
# netcheck.sh: layered connectivity check. Usage: ./netcheck.sh [host] [port]
set -u

host="${1:-example.com}"
port="${2:-443}"

pass() { printf '  [PASS] %s\n' "$1"; }
fail() { printf '  [FAIL] %s\n' "$1"; }
warn() { printf '  [WARN] %s\n' "$1"; }

echo "Checking ${host}:${port}"

# 1. Gateway: some routers ignore ping, so treat this as a warning, not a stop.
gw=$(ip route show default 2>/dev/null | awk '/default/ {print $3; exit}')
if [ -z "$gw" ]; then
  fail "No default gateway configured"; exit 1
elif ping -c 1 -W 2 "$gw" >/dev/null 2>&1; then
  pass "Gateway $gw answers"
else
  warn "Gateway $gw did not answer ping (may just be ignoring ping)"
fi

# 2. DNS: getent uses the system resolver, including the hosts file.
ip=$(getent ahostsv4 "$host" | awk 'NR==1 {print $1}')
if [ -n "$ip" ]; then pass "DNS: $host -> $ip"; else fail "DNS: cannot resolve $host"; exit 1; fi

# 3. TCP: Bash can open a TCP connection itself via /dev/tcp.
if timeout 5 bash -c "exec 3<>/dev/tcp/$ip/$port" 2>/dev/null; then
  pass "TCP $port open on $ip"
else
  fail "TCP $port not reachable on $ip (firewall, routing or service down)"; exit 1
fi

# 4. HTTPS: only meaningful for port 443.
if [ "$port" = "443" ]; then
  if code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 10 "https://$host/" 2>/dev/null); then
    pass "HTTPS answered with status $code"
  else
    fail "HTTPS request failed (certificate or application problem)"; exit 1
  fi
fi

Make it executable and run it:

chmod +x netcheck.sh
./netcheck.sh example.com 443

PowerShell version (Windows)

Save this as netcheck.ps1:

# netcheck.ps1: layered connectivity check. Usage: .\netcheck.ps1 -HostName example.com -Port 443
param(
    [string]$HostName = 'example.com',
    [int]$Port = 443
)

function Pass($msg) { Write-Host "  [PASS] $msg" -ForegroundColor Green }
function Fail($msg) { Write-Host "  [FAIL] $msg" -ForegroundColor Red }
function Warn($msg) { Write-Host "  [WARN] $msg" -ForegroundColor Yellow }

Write-Host "Checking ${HostName}:$Port"

# 1. Gateway
$gw = (Get-NetRoute -DestinationPrefix '0.0.0.0/0' -ErrorAction SilentlyContinue |
       Sort-Object RouteMetric | Select-Object -First 1).NextHop
if (-not $gw) { Fail 'No default gateway configured'; exit 1 }
if (Test-Connection $gw -Count 1 -Quiet) { Pass "Gateway $gw answers" }
else { Warn "Gateway $gw did not answer ping (may just be ignoring ping)" }

# 2. DNS
try {
    $ip = (Resolve-DnsName -Name $HostName -Type A -ErrorAction Stop |
           Where-Object Type -eq 'A' | Select-Object -First 1).IPAddress
    if (-not $ip) { throw 'no A record' }
    Pass "DNS: $HostName -> $ip"
} catch { Fail "DNS: cannot resolve $HostName"; exit 1 }

# 3. TCP
if (Test-NetConnection -ComputerName $ip -Port $Port -InformationLevel Quiet -WarningAction SilentlyContinue) {
    Pass "TCP $Port open on $ip"
} else { Fail "TCP $Port not reachable on $ip (firewall, routing or service down)"; exit 1 }

# 4. HTTPS
if ($Port -eq 443) {
    try {
        $r = Invoke-WebRequest -Uri "https://$HostName/" -Method Head -UseBasicParsing -TimeoutSec 10
        Pass "HTTPS answered with status $($r.StatusCode)"
    } catch { Fail "HTTPS request failed (certificate or application problem)"; exit 1 }
}

Run it from PowerShell in the folder where you saved it:

.\netcheck.ps1 -HostName example.com -Port 443

If Windows refuses to run the script because of the execution policy, read the message carefully. Unblocking a file you wrote yourself (Unblock-File .\netcheck.ps1) is different from switching off script protection for the whole machine.

How to read the output

The first [FAIL] line is the one that matters, and the script stops there, because later checks would fail for the same reason. A gateway that ignores ping only produces a [WARN], because plenty of routers are configured that way, so the script carries on to the DNS check.

Extend it

• Accept a list of hosts and check each one, so you can test an app and its dependencies in one go.
• Add a check against a second DNS resolver to tell “my resolver is broken” from “this name is broken”.
• Write the results to a timestamped log file, so a user can run it and send you the output.

Expected result

Running the script against example.com prints four [PASS] lines on a healthy connection. Point it at a name that doesn’t exist, or a closed port, and it stops at the matching [FAIL].

Key lessons

• Run checks in dependency order and stop at the first real failure.
• Separate warnings from failures, so a router that ignores ping does not derail the diagnosis.
• Read any script before you run it, especially one from the internet.