Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Stop curl from hiding the network handshake details

🧩 The Challenge

You’re trying to debug why a service can’t reach an API, but curl just sits there blinking or gives you a generic error. You have no idea if it died at DNS, the TCP handshake, or the TLS negotiation.

💡 The Fix

Use the write-out feature in curl to dump the actual timing and connection data instead of guessing. It turns a mystery failure into a clear view of exactly where the handshake stalled.

curl -w "DNS: %{time_namelookup}s\nTCP: %{time_connect}s\nTLS: %{time_appconnect}s\nTotal: %{time_total}s\n" -so /dev/null https://your-service-endpoint.com

⚙️ Why It Works

Passing variables to the -w flag pulls metrics directly from the libcurl engine after the transfer completes. If your TLS time is massive, you know your firewall or proxy is chewing on the certificate verification.

🚀 Pro-Tip: Alias this as curl-debug in your bashrc so you don’t have to memorize the format string when your brain is already fried.

Linux Tips & Tricks | © ngelinux.com | 7/24/2026