tcpdump for DevOps: Read a TCP Handshake and Stop Guessing
When a service "can't connect," the app logs and the network rarely tell the same story. tcpdump settles the argument: it shows what actually went over the wire, not what the client library claims happened. Learning to read three packet signatures is usually enough to split a network problem from an application problem in under a minute. One ground rule first: only capture on systems you own or…
When services fail to connect, logs and network diagnostics often point in different directions. tcpdump clears up the confusion by revealing what actually traversed the network, not just what client libraries claim. Mastering three packet signatures usually helps differentiate network issues from application issues within a minute.
First rule: only capture on systems you own or have explicit authorization to access. Pcap files can contain sensitive data, so treat them as confidential and delete them after use. Capture only what you need to avoid drowning in unnecessary data. Filter your capture by specifying the correct interface, host, and port to focus on the relevant traffic.
The three common packet signatures are:
1. A healthy connection: A proper TCP handshake involving three messages (SYN, SYN-ACK, ACK) in both directions indicates that both the network path and the listening service are functioning correctly. In this case, the issue likely lies above the transport layer, such as TLS, authentication, or an application error.
2. Connection refused: If a SYN packet receives an immediate RST (reset) response, it means the connection was denied. This could be due to the service not being up, bound to the wrong interface, or a proxy rejecting the connection. The rapid response time indicates a deliberate refusal rather than a delayed response.
3. Timeout / silence: When a SYN packet is sent but no response is received after multiple retransmissions, it signifies a timeout or silence. This could be caused by a security group, iptables rule, missing route, or a non-responsive host. Unlike a refusal, a timeout or silence remains silent, indicating that the packet was dropped rather than explicitly rejected.
Remember to consider DNS (Domain Name System) resolution, as half of network outages stem from name resolution issues. A healthy DNS lookup involves a query followed by a response containing an IP address. If the query leaves without a response, the problem lies in the DNS resolver, not the connectivity itself.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
