adminTcpdump Basic Packet Capture Checklist for VPS Troubleshooting
tcpdump lets system admins observe network packets on a server. It is useful when logs are not enough and you need to confirm whether traffic reaches the VPS, which port receives packets or whether a service responds.
Core principle
Packet capture is evidence at the network layer. Use it carefully, capture only what you need and avoid exposing sensitive data.
Checklist
- Define the exact question before capturing.
- Choose the network interface.
- Limit capture by host, port or protocol.
- Capture briefly.
- Avoid capturing sensitive payloads when possible.
- Check whether packets reach the server.
- Check whether responses leave the server.
- Compare packet evidence with firewall and service status.
- Save capture only if needed.
- Delete sensitive captures after analysis.
Reusable lesson
tcpdump applies to firewall debugging, DNS issues, webhook delivery, API connectivity, reverse proxy problems, database network checks and cloud routing troubleshooting.
When to Use This Checklist
Use this checklist when you need network-layer evidence for traffic, firewall, webhook, API, DNS, reverse proxy or connectivity problems on your own server.
Required Tools
SSH access, sudo access, tcpdump, target host or port, incident time, permission to inspect the server network
Before You Start
Only capture traffic on systems you own or are authorized to administer. Packet captures may contain sensitive data.
Structured Checklist Steps
- Define question.
- Choose interface.
- Set host filter.
- Set port filter.
- Keep capture short.
- Check incoming packets.
- Check outgoing responses.
- Compare firewall.
- Save only if needed.
- Clean sensitive captures.
Verification Steps
- Capture scope is limited.
- Traffic reachability is confirmed or ruled out.
- Firewall or service layer is clearer.
- No unnecessary sensitive capture is kept.
- Next debugging step is evidence-based.
Rollback Plan
If packet capture shows traffic reaches the server but the app does not respond, stop changing network settings and inspect firewall, listening ports and service logs.
Common Mistakes
- Capturing everything for too long.
- Ignoring sensitive data risk.
- No clear debugging question.
- Using tcpdump before basic curl and ss checks.
- Saving captures without cleanup.
Related Commands
sudo tcpdump -i any port 443 -c 50
sudo tcpdump -i any host 1.2.3.4 -c 50
sudo tcpdump -i any tcp port 80 -n -c 50
sudo ss -tulpn
sudo ufw status numbered