Phase 1: Foundations

Network debugging with tcpdump, traceroute & wireshark

Beginner ~3 min read
Think of it this way A friendly analogy. Read this if the technical version feels dense. Show Hide

Imagine you're trying to send a message to a friend across town, but it’s taking forever, or maybe it’s not arriving at all! In the world of computers and the internet, your computer constantly sends and receives countless tiny messages, like asking for a webpage or playing an online game. When something goes wrong – like a website not loading or a video freezing – it can feel like these messages are lost or stuck somewhere. You need to become a detective to figure out where the trouble is! That’s where some cool tools come in handy. Think of the internet like a giant, magical postal service, and your messages are like letters trying to reach their destination.

traceroute is like asking the postal service to give you a detailed list of every single stop your letter made along its journey. Did it go from your house, to the local post office, then to the main sorting center, and finally to your friend's town? traceroute shows you each post office or hub your message passed through, and crucially, how long it took to get from one stop to the next. If your letter got stuck for a long time at the 'main sorting center' hop, you'd know exactly where the delay was happening. This helps you figure out if the problem is close to your computer, far away near your friend's computer, or somewhere in the middle.

Now, let's say your letter did arrive, but your friend says it's empty, or they received the wrong message! This is where tcpdump and Wireshark come in. tcpdump is like having a special, invisible camera at a specific post office that takes a picture of every single letter that passes through. You can tell it, 'Only take pictures of letters going to Sarah!' or 'Only show me letters about dragons!' This lets you see the actual words inside the envelopes as they pass by. But looking at thousands of pictures can be messy! That’s where Wireshark helps. It's like a super smart assistant who takes all those pictures, organizes them into neat albums, and even highlights important parts so you can easily read the story of what happened to your letters. You can quickly see if your letter was sent correctly, if it arrived with the right message, or if anything got lost.

So, by using traceroute to map the path, and tcpdump along with Wireshark to inspect the contents of your computer's messages, you can figure out exactly why your online game is lagging, why a website isn't loading, or why your computer isn't talking properly to another computer. It lets you become a super detective of the internet, finding clues and solving mysteries that help everything work smoothly!

As an SRE, understanding network issues is paramount to keeping services reliable. traceroute, tcpdump, and Wireshark are your primary tools for peering into the network's soul. traceroute helps you map the path your network packets take to reach a destination, showing each hop (router) and the latency to it. This is invaluable for pinpointing where delays are introduced or where connectivity breaks down along the route to a server, helping you quickly identify if a problem is local, upstream, or somewhere in between. For example, high latency at a specific hop often indicates a congested router or a problem with that particular network segment.

Once you know the path, tcpdump allows you to capture raw network traffic directly from your server's command line. Think of it as a tap into the network cable, showing you exactly what packets are being sent and received by your machine. You can filter this output to focus on specific IP addresses, ports, or protocols, making it incredibly powerful for verifying if traffic is actually reaching your service, if a client is sending the correct requests, or if a firewall is silently dropping packets. Seeing the actual bytes on the wire can reveal misconfigurations, unexpected responses, or even malformed packets that higher-level application logs might miss.

While tcpdump is great for quick command-line analysis, Wireshark takes packet analysis to the next level with a powerful graphical user interface. You can use Wireshark to open .pcap files captured by tcpdump (or capture live traffic itself) and visualize the data in a much more digestible way. It automatically decodes various network protocols (HTTP, DNS, TLS, etc.), allowing you to inspect packet contents, reassemble conversations, and apply complex filters to find exactly what you're looking for. Together, traceroute tells you where packets go, tcpdump shows you what packets are there, and Wireshark helps you understand why they are (or aren't) behaving as expected, forming a complete toolkit for network-level debugging.

Key Takeaways

  • traceroute maps the network path and measures latency to each hop.
  • tcpdump captures raw network packets directly from the command line, allowing for real-time traffic inspection.
  • Wireshark provides a powerful GUI for deep analysis of captured packets, decoding protocols and visualizing network conversations.
  • Use traceroute to identify path issues, tcpdump to confirm traffic presence, and Wireshark for detailed content analysis.
  • These tools are essential for diagnosing connectivity, latency, and application communication problems at the network layer.

Code Example

bash
# Trace the path to a remote host (e.g., google.com)
traceroute google.com

# Capture HTTP (port 80) and HTTPS (port 443) traffic on interface eth0
# -i eth0: specify network interface
# 'port 80 or port 443': filter for traffic on these ports
# -nn: don't convert IPs to hostnames or port numbers to names
# -v: verbose output
sudo tcpdump -i eth0 'port 80 or port 443' -nn -v

# Capture 10 packets and save to a file for Wireshark analysis
sudo tcpdump -i eth0 -c 10 -w /tmp/capture.pcap

How this code works

This code demonstrates essential tools for diagnosing network connectivity and inspecting traffic. First, traceroute is used to map the route data packets take to a remote host like google.com. It reveals each "hop" – typically a router – the packets pass through, along with the time taken, helping to identify where a connection might be slowing down or failing on its journey.

Next, tcpdump captures and displays network traffic. The first tcpdump command monitors specific HTTP (port 80) and HTTPS (port 443) traffic on the eth0 network interface (-i eth0). The port 80 or port 443 filter ensures only web-related data is shown. A subtle but important flag is -nn, which prevents tcpdump from converting IP addresses to hostnames or port numbers to service names (like 'http' for 80). This ensures raw, fast output without relying on potentially slow or failing DNS lookups. The -v flag provides verbose details about each captured packet. Finally, tcpdump -c 10 -w /tmp/capture.pcap captures only 10 packets (-c 10) and saves them to a .pcap file (-w), ideal for deeper analysis later with a tool like Wireshark. Note that both tcpdump commands require sudo privileges to capture raw network data.

Resources

Related Articles

Hand-picked reads to go deeper on networking for sre.

Back to Site Reliability Engineer Roadmap