Network diagnosis

Capture on the box, analyze elsewhere. Always write a file rather than reading live.

Start with

tcpdump -i any -nn -s0 -w cap.pcap 'port 443'

The gotcha

Without -s0 on older builds you get truncated packets and a confusing analysis an hour later.

tshark for filtering in a terminal or a pipeline; the GUI for following a stream by eye.

Start with

tshark -r cap.pcap -Y 'tls.handshake.type==1'

The gotcha

Display filters and capture filters are different syntaxes. Most confusion starts there.

Proving what actually resolves, from where, and with what TTL remaining.

Start with

dig +trace example.com

The gotcha

+trace bypasses your resolver cache, which is the point. Without it you are testing the cache, not DNS.

Continuous traceroute with loss per hop. Far more useful than a one-shot traceroute.

Start with

mtr -rwzbc 100 example.com

The gotcha

Mid-path loss is usually ICMP rate limiting, not real. Only loss that persists to the final hop counts.

Connection counts, states and owning processes. The first place I look for port exhaustion.

Start with

ss -tan state time-wait | wc -l

The gotcha

Replaces netstat. If a runbook still says netstat, the runbook is old enough to be wrong elsewhere too.

Separating a bandwidth problem from an application problem, which is most of them.

Start with

iperf3 -c host -P 4 -t 30

The gotcha

A single stream measures the TCP stack and the path together. Use parallel streams to tell them apart.

Certificate chains, expiry, SNI and protocol negotiation, without a browser in the way.

Start with

openssl s_client -connect host:443 -servername host </dev/null | openssl x509 -noout -dates

The gotcha

Omit -servername and you will be served the default virtual host, then debug the wrong certificate.