{
  "id": 1760720,
  "title": "tcpdump for DevOps: Read a TCP Handshake and Stop Guessing",
  "url": "https://urgent.news/2026/08/18/tcpdump-for-devops-read-a-tcp-handshake-and-stop-guessing",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-18T17:07:07.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jjoyneriv/tcpdump-for-devops-read-a-tcp-handshake-and-stop-guessing-3a2f"
  },
  "original_language": "en",
  "account": "When services fail to connect, logs and network diagnostics often point in different directions. tcpdump clears up the confusion by revealing what actually traversed the network, not just what client libraries claim. Mastering three packet signatures usually helps differentiate network issues from application issues within a minute.\n\nFirst rule: only capture on systems you own or have explicit authorization to access. Pcap files can contain sensitive data, so treat them as confidential and delete them after use. Capture only what you need to avoid drowning in unnecessary data. Filter your capture by specifying the correct interface, host, and port to focus on the relevant traffic.\n\nThe three common packet signatures are:\n\n1. A healthy connection: A proper TCP handshake involving three messages (SYN, SYN-ACK, ACK) in both directions indicates that both the network path and the listening service are functioning correctly. In this case, the issue likely lies above the transport layer, such as TLS, authentication, or an application error.\n\n2. Connection refused: If a SYN packet receives an immediate RST (reset) response, it means the connection was denied. This could be due to the service not being up, bound to the wrong interface, or a proxy rejecting the connection. The rapid response time indicates a deliberate refusal rather than a delayed response.\n\n3. Timeout / silence: When a SYN packet is sent but no response is received after multiple retransmissions, it signifies a timeout or silence. This could be caused by a security group, iptables rule, missing route, or a non-responsive host. Unlike a refusal, a timeout or silence remains silent, indicating that the packet was dropped rather than explicitly rejected.\n\nRemember to consider DNS (Domain Name System) resolution, as half of network outages stem from name resolution issues. A healthy DNS lookup involves a query followed by a response containing an IP address. If the query leaves without a response, the problem lies in the DNS resolver, not the connectivity itself.",
  "summary": "When a service \"can't connect,\" the app logs and the network rarely tell the same story. tcpdump settles the argument: it shows what actually went over the wire, not what the client library claims happened. Learning to read three packet signatures is usually enough to split a network problem from an application problem in under a minute. One ground rule first: only capture on systems you own or…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}