anchor.diff:      "error":"dial tcp 10.0.32.15:60099: getsockopt: connection refused"}}
       </pre>
   - If the Gorouter successfully dials the endpoint but an error occurs:
  -    - Connection reset on read errors can occur when the application closes the connection. This will cause the Gorouter to retry the next endpoint.
  -    - TLS Handshake errors (this may not necessarily return a 502 but it's worth mentioning). These appear similar to the following in the `gorouter.log`:
  +    - `read: connection reset by peer` errors can occur when the application closes the connection abruptly with a TCP RST packet and not the expected FIN-ACK. This will cause the Gorouter to retry the next endpoint. Note, Gorouter does not currently retry on `write: connection reset by peer` failures.
  +    - TLS Handshake errors. When these errors occur, the Gorouter will retry up to three times and if it's still failing then a 502 may be returned. These errors appear similar to the following in the `gorouter.log` (and a 502 will be logged in the `access.log`):
       <pre class="terminal">
   		[2018-07-05 18:20:54+0000] {"log_level":3,"timestamp":1530814854.4359834,"message":"
       backend-endpoint-failed","source":"vcap.gorouter","data":{"route-endpoint":
       {"ApplicationId":"","Addr":"10.0.16.17:61002","Tags":null,"RouteServiceUrl":""},
       "error":"x509:certificate is valid for 53079ca3-c4fe-4910-78b9-c1a6, not xxx"}}
       </pre>
  -- If the Gorouter successfully dials the endpoint, but an error occurs while the request is in transport:
  -    - Prior to PCF 2.0, there was a bug that logged a 502 for requests canceled by clients before the server responded with headers. PCF 2.0 and beyond, if the same situation occurs, a 499 is returned.
  +    - If the Gorouter successfully connects to the endpoint, but an error occurs while the request is in transport (i.e. Gorouter has not received a response from the endpoint):
  +    - Prior to routing-release 0.166.0, there was a bug that logged a 502 for requests canceled by clients before the server responded with headers. Routing-release 0.166.0 and beyond, if the same situation occurs, a 499 is returned.
   
  -In an **Application**, 502's can occur in the following ways:
  +In an **Application**, 502's can occur in the following ways (Note: the Gorouter will not retry any error response that is returned by the application):
   
  -- If 502's are only occuring from a particular application instance(s) and not all of the applications on the PCF platform, then it is likely an application error (i.e. application is overloaded, unresponsive, etc.). If all applications are experiencing 502's, then it's likely a platform issue (possible misconfiguration).
  +- If 502's are only occuring from a particular application instance(s) and not all of the applications on the CF platform, then it is likely an application-related error (i.e. application is overloaded, unresponsive, can't connect to database, etc.).
  +- If all applications are experiencing 502's, then it could either be a platform issue (possible misconfiguration) or an application issue (i.e. all applications are unable to connect to an upstream database).
   
   ## <a id="debugging-steps"></a> General Debugging Steps
   
  
positive.code: 
  Error Type | Status Code | Source of Issue | Evidence
  ------------ | ------------- | ------------- | -------------
  Dial | 502 | Application or Platform | - logs with error `dial tcp`
  ConnectionResetOnRead | 502 | Application or Platform | - logs with error `read: connection reset by peer`
  AttemptedTLSWith<br/>NonTLSBackend | 525 | Platform* | - logs with error `tls: first record does not look like a TLS handshake`<br/> - `backend_tls_handshake_failed` metric increments
  HostnameMismatch | 503 | Platform | - logs with error `x509: certificate is valid for <x> not <y>`<br/> - `backend_invalid_id` metric increments
  UntrustedCert | 526 | Platform | - logs with an error prefix `x509: certificate signed by unknown authority`<br/> - `backend_invalid_tls_cert` metric increments
  RemoteFailedCertCheck | 496 | Platform | - logs with error remote `error: tls: bad certificate`
  ContextCancelled | 499 | Client/App | - logs with error `context canceled`
  RemoteHandshakeFailure | 525 | Platform | - logs with error remote `error: tls: handshake failure`<br/> - `backend_tls_handshake_failed` metric increments
  *Note: any platform issue could be the result of a misconfiguration
  
  For each of the above errors, there will be a `backend-endpoint-failure` log line in `gorouter.log` and an error message in `gorouter.err.log`. Additionally, the `access.log` will record the request status codes.
  
negative.code: 
  <strong><%= modified_date %></strong>
  
  This topic helps operators to better understand if 502's are a result of the Cloud Foundry Platform or an application.
  
  ## <a id="points-of-failure"></a> Points of Failure
  
  