C4 network check, 2026-10-23 (UTC+8). strace -f -e trace=connect,sendto,sendmsg on 'ollama serve' for the whole session.

Phases (box clock):
08:49:22 phase=serve-start
08:49:33 phase=pull qwen2.5:1.5b
08:50:39 phase=pull-done
08:50:51 phase=pull hf.co
08:51:56 phase=pull-hf-done
08:52:10 phase=create
08:52:13 phase=create-done
08:52:45 phase=tests-start (C2,C3,C5 under strace)
08:54:06 phase=tests-done
08:54:30 phase=offline-netns-start
08:54:40 phase=offline-netns-done


== server start 08:49:22-08:49:32: 4 IP connects, 4 to non-loopback addresses
  08:49:22.513701 10.0.0.2:53
  08:49:22.513807 10.0.0.2:53
  08:49:22.514974 198.18.0.1:443
  08:49:22.515010 198.18.0.1:443

== pull attempts (expected network) 08:49:33-08:52:09: 63 IP connects, 63 to non-loopback addresses
  08:49:33.809435 10.0.0.2:53
  08:49:33.809794 10.0.0.2:53
  08:49:33.810983 198.18.0.1:443
  08:49:34.594872 10.0.0.2:53
  08:49:34.594990 10.0.0.2:53
  08:49:34.596021 198.18.0.1:443
  08:49:34.780860 10.0.0.2:53
  08:49:34.781214 10.0.0.2:53
  08:49:34.896470 10.0.0.2:53
  08:49:34.896696 10.0.0.2:53
  08:49:35.039176 10.0.0.2:53
  08:49:35.039290 10.0.0.2:53
  ... 51 more (DNS retries to 10.0.0.2:53)

== GGUF import 08:52:10-08:52:44: 0 IP connects, 0 to non-loopback addresses

== C2/C3/C5 prompts: 10 quiz + 1 long + 4 OpenAI-client + 10 JSON-schema 08:52:45-08:54:06: 109 IP connects, 0 to non-loopback addresses

Server start: 2 DNS lookups + 2 HTTPS connects (198.18.0.1:443) at 08:49:22.51, in the same 0.4 s as the log line 'model recommendations cache sleep scheduled'. We could not see the host name or payload (TLS, fake-IP DNS); no prompt had been sent yet.

== Offline run: second server (port 11435) inside a network namespace with only loopback (sudo unshare -n)
netns interfaces:
lo               UNKNOWN        127.0.0.1/8 ::1/128 
outside-check ollama.com http=000
outside-check: no network (curl rc=6)
'391' 4 tok
'Canberra' 3 tok
'Jane Austen' 4 tok

strace in the namespace: 4 non-loopback connect attempts, all at server start (DNS to 10.0.0.2:53 -> ENETUNREACH); answers still came back: 3/3 correct.
  08:54:30.616790 10.0.0.2:53  -1 ENETUNREACH (Network is unreachable)
  08:54:30.616879 10.0.0.2:53  -1 ENETUNREACH (Network is unreachable)
  08:54:30.616969 10.0.0.2:53  -1 ENETUNREACH (Network is unreachable)
  08:54:30.616999 10.0.0.2:53  -1 ENETUNREACH (Network is unreachable)

== Extra (not scored): server started with OLLAMA_NO_CLOUD=1 (port 11436), traced for 10 s: 0 non-loopback connects; log 'Ollama cloud disabled: true'.