Diagnose the complete path
Capture and read packets
Use an authorized packet capture to confirm DNS exchanges, handshakes, retransmissions, resets, and application bytes.
8 minute lesson
A packet capture shows what crossed an interface. Capture only traffic you own or are authorized to inspect, because packets may contain private application data.
A narrow filter keeps the evidence readable:
sudo tcpdump -ni any host 192.0.2.20 and port 443Look for a DNS query and reply, TCP SYN and SYN-ACK, repeated retransmissions, resets, TLS alerts, or application responses. Missing packets are evidence too when compared with captures from both endpoints.
Wireshark can decode the same layers visually. Remember that capture offloading and encryption can affect what you see. Correlate packets with application and firewall logs.
Capture a small, bounded sample instead of recording everything:
sudo tcpdump -ni any -c 20 'icmp or port 53'In another terminal, run one ping and one DNS lookup. Match each request with its reply. Notice the source, destination, protocol, and timing. Do not capture production traffic casually: packets can contain private addresses, names, tokens, and unencrypted application data.
Lesson completed