Capture and finish the service

The service works. The last step is looking at it from outside: capture actual packets and confirm the bytes on the wire match the contract.

A packet capture verifies framing and timing outside both implementations. That independence is the point — if your client and server share the same framing bug, they agree with each other and every test passes anyway. tcpdump has no such loyalty. It shows what actually crossed the interface, and plaintext lab traffic will reveal the protocol exactly.

Capture only the lab port:

sudo tcpdump -ni lo0 port 4000
# Linux commonly uses: sudo tcpdump -ni lo port 4000

-n skips name resolution, -i selects the loopback interface (macOS calls it lo0, Linux lo), and port 4000 filters to your service. Add -A to print payloads as ASCII and you’ll see your JSON lines exactly as sent.

Run a session against the capture and read it: the three-way handshake (flags S, S., then .), data segments carrying your frames with the P push flag, and the FIN exchange at the end. Check that segment payload lengths line up with your maximum line size and that the idle timeout closes the connection when it should.

The final test matrix

Run normal, fragmented, oversized, idle, and abrupt-close cases:

normal:       set/get/delete round trip -> contract replies
fragmented:   command split across writes -> one correct reply
oversized:    line beyond 4096 bytes -> error and close
idle:         silent connection -> closed at 30 s
abrupt close: kill the client mid-command -> server logs and cleans up

Save expected outcomes and a cleanup command with the project: how to start the service, how to stop it, and how to confirm the port is free again (ss -lnt | grep 4000 should print nothing). A service you can’t remove cleanly isn’t finished.

Two boundaries as you leave the lab. Capture only traffic you own or are authorized to inspect — on shared systems tcpdump sees everyone’s packets, and authorization is not optional. And everything in this course ran plaintext on loopback, which is exactly why the capture was so informative. Add TLS before sending secrets over a real network, because everyone on the path gets the same view tcpdump just gave you.