How do I capture a small, targeted network trace on a Linux server?
A targeted packet trace can show whether a client’s packets reach the server and whether the server replies. Keep the capture narrow: a production interface may carry other users’ private traffic. The example prints packet summaries for one client and TCP port without writing a capture file.
Before you start
- Authorisation to inspect the affected traffic.
- Sudo or the specific packet-capture capability.
- The real client source IP and service port.
Instructions
1. Confirm the capture interface
List available interfaces. The Linux any device can observe traffic across interfaces, but it can show related packets more than once on bridged or containerised hosts.
sudo tcpdump -DLists interfaces available to tcpdump; this does not begin a capture.
2. Capture only the affected connection
Replace 198.51.100.20 with the client address as seen by the server, accounting for NAT. Ask that client to retry once during the capture. The example stops after twenty seconds or thirty matching packets.
sudo timeout 20s tcpdump -ni any -c 30 'host 198.51.100.20 and tcp port 443'Numerical output avoids lookups. No -A, -X or -w option is used, so this prints summaries rather than dumping payloads or saving a packet file.
3. Interpret direction and flags
SYN packets without replies, immediate resets and completed handshakes point to different stages. Compare timing with service logs. Share only the minimal redacted evidence needed for the incident.
Check the result
- The trace establishes whether the selected connection reaches the server and whether responses leave it.
Troubleshooting
- No packets appear
- Check NAT, the address family, interface and port filter before concluding that the provider is blocking traffic.
- The command exits with status 124
- GNU timeout reached the configured duration; this is expected for a quiet capture, not proof of a network failure.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.