curl

Captured 2026-08-03 from one CE of this deployment.

Two commands, and the distinction between them is the entire value.

curl-host

Runs in the host network namespace — the node’s own connectivity, before the data plane is involved.

{"command":["curl-host","-v","cloud.f5.com"]}

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying <public-ip>:80...
* Connected to cloud.f5.com (<public-ip>) port 80 (#0)
> GET / HTTP/1.1
> Host: cloud.f5.com
> User-Agent: curl/7.76.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
< location: https://cloud.f5.com/
< server: volt-adc
< date: Mon, 03 Aug 2026 16:30:24 GMT
< connection: close
< content-length: 0
<
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
* Closing connection 0

curl-vega

Runs in the Vega (control plane) context rather than the host’s. The observable difference, and the only one established here, is the environment it inherits: curl-vega reports a NO_PROXY list covering the private ranges, int.ves.io, int.volterra.us and the site’s own .tenant.local domain, and curl-host reports none. What that implies about the DNS path is not measured.

{"command":["curl-vega","-v","cloud.f5.com"]}

* Uses proxy env variable NO_PROXY == '10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,100.127.0.0/18,100.127.192.0/18,169.254.0.0/16,int.ves.io,int.volterra.us,mcn-ce-ha-eastus01.<tenant>.tenant.local'
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying <public-ip>:80...
* Connected to cloud.f5.com (<public-ip>) port 80 (#0)
> GET / HTTP/1.1
> Host: cloud.f5.com
> User-Agent: curl/7.76.1
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 301 Moved Permanently
< location: https://cloud.f5.com/
< server: volt-adc
< date: Mon, 03 Aug 2026 16:30:26 GMT
< connection: close
< content-length: 0
<
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
* Closing connection 0

The pair is a bisection

Run both. If curl-host succeeds and curl-vega fails, the node has connectivity and something in the control-plane context does not — its proxy settings or its resolver. If both fail, the problem is upstream of the node: routing, a firewall, or the egress path. If only curl-host fails, you have found something unusual and should check the host routing table first.

On a healthy node both succeed and reach the same address, so a clean pair proves nothing about which context is in use — it is the divergence that carries the information.

Both accept normal curl arguments as separate array elements. -v is worth keeping because the connection and TLS handshake lines are usually where the failure shows.