A fault is easier to recognise once you know what a healthy exchange looks like. Remove the drop rule and record one of the monitor's connections into a file.
The rule lives in /opt/packets-lab/rules.nft, as in the lesson on filters: edit the file, then load it with nft -f.
A good connection in a file
Delete the drop rule from /opt/packets-lab/rules.nft and load the file on lab-node2. Then record six port 8080 packets into the file open.pcap in ~/packets and read the recording.
First, predict
What will tcpdump with -w open.pcap print on the screen?
Now start the exercise, run the command and compare your prediction with the output.
A TCP connection opens with three packets, the handshake: the client sends [S], the server answers [S.], the client confirms with [.]. The dot in the brackets is the ACK flag, an acknowledgement of what was received.
| Flags | What they mean |
|---|---|
[S] |
SYN: open a connection |
[S.] |
SYN and ACK: the server agrees |
[.] |
ACK: an acknowledgement |
[P.] |
data, the line's length is above zero |
[F.] |
FIN: close the connection |
[R.] |
RST: break the connection off or refuse at once |
The monitor, nc -z, only checks that the port accepts a connection and closes it right away: [F.] from both sides follows the handshake. Requesting a page would add [P.] lines.
With -w you get a packet capture: the packets are written to a file whole and not printed. The file belongs to the tcpdump user, and you can read it without sudo — as many times as you like and with another filter:
The filter is the expression at the end of the command: host 192.0.2.11 — packets to and from the address, port 8081, tcp, icmp. Parts are joined with and, or and not: tcp and not port 22.