linux · medium

Is the Data on the Wire? — tcpdump Capture & Filters

tcpdump confirms whether data physically arrives. A tight -nn filter shows the handshake and payload; you diagnose by absence (firewall vs app-not-reading vs nothing-listening); save with -w for Wireshark and check ethtool -S for NIC-level drops below tcpdump.

The code

sudo tcpdump -i eth0 -nn host 10.0.0.9 and port 8080
#  -nn = no DNS/port-name lookups   -i any = all interfaces

sudo tcpdump -i eth0 -w cap.pcap port 8080   # save -> Wireshark
tcpdump -A port 8080                         # -A = ASCII payload

# NIC-level drops (frames lost before software sees them)
ethtool -S eth0 | grep -i 'drop\|miss'

What this lesson walks through

1. 01Capture exactly the traffic you care about
2. 02Diagnose by what you DON'T see
3. 03Save to pcap; check NIC drops below tcpdump

If you see packets here, the wire and routing are fine — the fault is higher up (firewall, bind, or the app).