Networking / Stage 14 of 15

What the packets show

Not running Starting usually ~20 s

Step 7 of 7 · summary · 2 min

Summary

A tcpdump line is one packet: the time, sender > receiver, the flags and the data length.
tcpdump sees an incoming packet before the nftables filter and an outgoing one after it.
A healthy connection is [S], [S.], [.]; drop is a SYN and repeats with no reply; reject is ICMP "port unreachable"; an empty port and reject with tcp reset give [R.].
A filter (host, port, and, not) keeps the packets you need, -w saves them to a file, -r reads the capture without sudo.
The monitor at the start of the lesson waited until the timeout: its SYNs reached lab-node2, and the drop rule discarded them without a reply.

Ubuntu 24.04