Capture a focused packet trace

A packet capture is the ground truth for one question: did the bytes actually arrive? Logs can lie by omission and metrics average things away, but a packet either crossed the interface or it didn’t. Reach for a capture when logs on both ends disagree, or when connections fail with no error on either side.

One rule before anything else: only capture traffic on systems you’re authorized to inspect, and keep the capture narrow. Traces can contain credentials and user data.

Capture with a filter, always

Filter by host, port, and protocol so you record one conversation, not the whole interface:

sudo tcpdump -ni any host 203.0.113.40 and port 443 -c 200

-n skips DNS lookups (they’re slow and add noise), any covers all interfaces, and -c 200 stops after 200 packets so a forgotten capture can’t fill the disk.

Read the handshake

A healthy TCP connection opens with three packets:

10.0.2.5.51844 > 203.0.113.40.443: Flags [S], seq 1290481, ...
203.0.113.40.443 > 10.0.2.5.51844: Flags [S.], seq 884211, ack 1290482, ...
10.0.2.5.51844 > 203.0.113.40.443: Flags [.], ack 1, ...

The Flags field carries the diagnosis. [S] is the client’s SYN. [S.] is SYN-ACK — the server answered. [R] is a reset: something actively refused or tore down the connection, which points at the application or an in-path device, not a silent drop. Repeated [S] with no reply means packets leave and nothing comes back — a filter or routing problem. Lines marked retransmission mean packets are being lost mid-conversation. After the handshake, look for TLS alerts and actual application bytes; length 0 keepalives aren’t data.

Remember what a capture can’t tell you

A packet capture shows what crossed one interface, not what happened everywhere. A missing SYN here means it didn’t arrive here — it may have left the client fine and died at a firewall in between. Capture on both sides when a middle boundary is uncertain, and save to files you can compare:

sudo tcpdump -ni any host 203.0.113.40 and port 443 -w /var/tmp/server-side.pcap -c 500

The trap: concluding “the client never sent it” from a server-side capture alone. Absence of evidence on one interface is not absence of the packet. Capture one connection you own with tcpdump -ni any host ADDRESS and port PORT, and match packets to the client and server logs by timestamp — that three-way comparison settles most arguments about whose side is broken.