OSI and TCP/IP as evidence, not vibes

Workflow

1. Write the smallest hypothesis

   Name one failure mode (DNS path, routing reachability, TCP loss/retransmits, TLS hostname mismatch, or L7 5xx).
2. Collect one signal

   Pick one measurement that would prove/disprove your hypothesis (timings, error codes, handshake details, traceroute hops).
3. Change one thing

   Do one intervention only (use a different resolver, change one ACL, adjust one timeout), and keep everything else constant.
4. Verify impact

   Re-run the same measurement and record what changed. If nothing changed, revert and pick the next hypothesis.
5. Write a CPD note (optional)

   Record: assumption, evidence, decision, and next step. That’s what makes your work defensible.