The scenario indicates that network-layer connectivity is functional (users can ping the IP), but application-layer access is failing (browsers cannot reach the web server). The web server process is confirmed to be running. The most logical first step on the server is to verify if the web server process is correctly bound to and listening on the expected network ports (e.g., TCP port 80 for HTTP, 443 for HTTPS). The netstat command is the primary tool for this, as it displays active network connections and listening ports. This will quickly determine if the issue is with the web server's configuration or a local firewall blocking the port.

A. traceroute: This command traces the network path to a destination. Since ping already confirms end-to-end IP connectivity, running a traceroute is not the most logical first step.

C. tcpdump: This is a packet capture tool. While useful, it is a more advanced step used for deep inspection after simpler checks, like verifying the service is listening, have been performed.

D. arp: This command manages the IP-to-MAC address resolution cache. As ping is successful, the Address Resolution Protocol (ARP) is already functioning correctly for local communication.

1. Nemeth

E.

Snyder

G.

Hein

T. R.

Whaley

B.

& Mackin

D. (2018). UNIX and Linux System Administration Handbook (5th ed.). Addison-Wesley Professional. In Chapter 20

"Network Management and Debugging

" the section "netstat: Get Network Statistics" describes its utility to "see which services are running on your machine by looking at the list of listening sockets" (p. 648). This directly addresses the troubleshooting need in the question.

2. Red Hat. (2023). RHEL 8 Configuring and managing networking. Red Hat Customer Portal. In Chapter 50

"Troubleshooting networking problems

" Section 50.1

"A general approach to troubleshooting networking

" Step 4 recommends: "Verify that the service is running and listening on the expected port... Use the ss -tlpn command to list all listening TCP sockets." The ss command is the modern replacement for netstat

serving the same diagnostic purpose.

3. Hunt

C. (2012). TCP/IP Network Administration (3rd ed.). O'Reilly Media. Chapter 15

"Troubleshooting TCP/IP

" outlines a systematic approach. After verifying IP layer connectivity with ping

the next step is to check the application itself

for which it states

"The netstat command provides information about the status of the network connections." It specifically highlights using netstat -a to check if a server is in the LISTEN state on the correct port.