The TCP/IP stack from the bottom up: physical/data link, network (IP, routing), transport (TCP/UDP), and application (HTTP, DNS). Operationally I apply this most often in three scenarios. First, diagnosing connectivity issues — I use `traceroute` and `mtr` to identify where packets are dropping, then check security group rules, NACLs, and routing tables in that order. Second, Nginx and load balancer tuning — I've had to increase `net.core.somaxconn` and `net.ipv4.tcp_max_syn_backlog` on high-traffic boxes to handle burst connections without dropping SYNs. Third, debugging latency — I use `ss -s` and `netstat` to check TCP retransmissions and TIME_WAIT buildup. On one occasion a service was accumulating thousands of TIME_WAIT connections because keep-alive was disabled; enabling it dropped connection establishment time by 40%.