Verifying the Network Layer
strace tells you what the application tried to do. tcpdump tells you what actually happened on the wire. If strace shows a connect() call hanging, tcpdump answers the follow-up question: did the SYN packet leave the machine? Did the server send a SYN-ACK back? Or is there silence — indicating a firewall is dropping packets?
Think of it like mailing a letter. strace tells you the application put the letter in the outbox. tcpdump lets you stand at the mailbox and watch whether the letter was actually picked up, and whether a reply ever arrived.
Essential tcpdump Capabilities
tcpdump can watch all traffic on a given interface and port, narrow the capture to traffic involving a specific host, filter down to just the connection-attempt (SYN) packets targeting a specific port, or save a capture to a file for deeper analysis in Wireshark. DNS resolution is normally disabled during a capture — otherwise the tool can hang trying to resolve addresses, which is exactly the wrong behavior when DNS itself might be the thing that's broken.
Interpreting the Output
Scenario A: Traffic is flowing, app is the problem
14:35:01.123456 IP 10.0.0.1.54321 > 10.0.1.50.80: Flags [S], seq 1234567890
14:35:01.124000 IP 10.0.1.50.80 > 10.0.0.1.54321: Flags [S.], seq 987654321, ack 1234567891
14:35:01.124100 IP 10.0.0.1.54321 > 10.0.1.50.80: Flags [.], ack 1
You see [S] (SYN), [S.] (SYN-ACK), [.] (ACK) — a complete TCP three-way handshake. The network is fine. The problem is in the application layer.
Scenario B: Firewall is dropping packets
14:35:01.123456 IP 10.0.0.1.54321 > 10.0.1.50.80: Flags [S], seq 1234567890
# ... silence for 30 seconds ...
14:35:31.123456 IP 10.0.0.1.54321 > 10.0.1.50.80: Flags [S], seq 1234567890
You see repeated SYN packets with no response. The packet is leaving the client but the server (or a firewall between them) is silently dropping it. Check AWS Security Groups, iptables, or network ACLs.
Scenario C: Nothing listening on that port
14:35:01.123456 IP 10.0.0.1.54321 > 10.0.1.50.5432: Flags [S]
14:35:01.124000 IP 10.0.1.50.5432 > 10.0.0.1.54321: Flags [R.] (RST)
An immediate [R.] (RST — reset) means the server received the packet but nothing is listening on that port. The service is down or bound to a different port.