Network Connection Troubleshooting & Error Playbook
Systematic, step-by-step diagnostic workflows for resolving web browser timeouts, DNS resolution failures, TLS certificate mismatches, and proxy handshake drops.
Quick Answer
Most browser connection errors stem from three layers: Layer 7 DNS failure (NXDOMAIN/SERVFAIL), Layer 4 TCP SYN timeout (ISP blocking or firewall filtering), or Layer 4 Path MTU black-holing where packets larger than the maximum transmission unit are silently discarded.
- Always verify whether an outage is global (DownDetector) or isolated to your local ISP loop.
- Flushing the OS DNS cache and Winsock stack resolves over 50% of transient NXDOMAIN errors.
- Lowering WAN MTU to 1420 bytes prevents packet fragmentation hangs on leased lines.
Common Browser Network Errors & Exact Diagnostic Steps
Technical definitions and step-by-step resolutions for common HTTP/TCP errors.
| Error String | Technical Layer | Primary Root Cause | Immediate Action Step |
|---|---|---|---|
| ERR_CONNECTION_TIMED_OUT | Layer 4 (TCP SYN) | Server unresponsive or ISP dropped SYN packets | Test with tcping; lower MTU to 1420; check firewall |
| DNS_PROBE_FINISHED_NXDOMAIN | Layer 7 (DNS Resolver) | Domain record does not exist or ISP hijacked DNS | Flush local cache; change resolver to 1.1.1.1 |
| ERR_SSL_PROTOCOL_ERROR | Layer 6 (TLS Handshake) | SNI filtering by firewall or antivirus MITM | Inspect cert in curl -vI; disable web shield; verify clock |
| ERR_TUNNEL_CONNECTION_FAILED | Layer 7 (HTTP Connect) | Proxy client offline or port 7890 closed | Restart proxy client; verify 127.0.0.1:7890 is listening |
| Cloudflare 403 / Ray ID Error | Layer 7 (WAF Rule) | IP reputation low or datacenter ASN blocked | Switch to clean residential leased line node |
Rapid Network Error Isolation Decision Tree
[ Identify Connection Error Type ]
|
+---------------------+---------------------+
| |
[ DNS / Name Resolution ] [ TCP / Handshake ]
| |
DNS_PROBE_FINISHED_NXDOMAIN ERR_CONNECTION_TIMED_OUT
| |
+---------+---------+ +---------+---------+
| | | |
Flush Local DNS Change to 1.1.1.1 Check Server Port Lower Router MTU
ipconfig /flush (Bypasses ISP Filter) via tcping / nmap (Avoid Black Holes)
Frequently Asked Questions
How do I fix ERR_CONNECTION_TIMED_OUT in Chrome?
ERR_CONNECTION_TIMED_OUT indicates the initial TCP SYN packet received no SYN-ACK response within roughly 21 seconds. Verify server reachability using tcping or curl -v. If reachable from other networks, the block is occurring at your local ISP, router firewall, or via an aggressive MTU black hole. Try lowering your router WAN MTU to 1472 or 1420 bytes.
How do I resolve DNS_PROBE_FINISHED_NXDOMAIN?
NXDOMAIN signifies that the recursive DNS resolver reported Non-Existent Domain. First, check if your local DNS cache is corrupted by running "ipconfig /flushdns" (Windows) or "sudo dscacheutil -flushcache" (macOS). If the error persists, switch your primary and secondary DNS to public anycast resolvers like 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google).
Why does my proxy fail to connect after waking my computer from sleep?
When a laptop sleeps, the operating system tears down active network adapters and socket pools. Proxy clients like Clash Verge can retain stale listening handles on 127.0.0.1:7890. Restart the client application, toggle system proxy off and on in OS network settings, or flush sockets in chrome://net-internals/#sockets.
Data & Technical Sources
- Chromium NetError Source Specifications — Standard error codes definitions
- IETF RFC 1191 — Path MTU Discovery