This guide walks you through the root causes of "port unreachable" problems, explains TCP and UDP handshakes, and provides a seven‑layer troubleshooting framework with concrete commands, scripts, case studies, best‑practice recommendations, and monitoring setups for Linux environments.
When a service crashes and users flood you with complaints, following a structured 15‑minute workflow—first narrowing the impact, then probing six layers (network, system, application, data, external services, security), and finally documenting the incident—lets you pinpoint and fix most outages quickly and reliably.
This tutorial walks you through setting up a local Java Spring Boot service, installing and configuring cpolar for HTTP tunneling, creating and fixing a public address, and using the cpolar listener to monitor and replay API requests, complete with code snippets and screenshots.
This article introduces pwru, Cilium's eBPF‑based packet‑tracing tool, explains kernel requirements, shows how to install the pre‑built binary, details command‑line options, and provides practical examples for filtering, output customization, and debugging dropped packets in Linux networking.
This article explains why Linux servers can experience mysterious packet loss, walks through a systematic debugging process from the link layer to the kernel TCP/IP stack, and provides practical solutions such as adjusting kernel parameters and increasing listen queue sizes to eliminate the issue.
The article examines why a TLS 1.3 upgrade still exhibited a two‑RTT handshake, traces the extra round‑trip to TCP’s Nagle algorithm, and shows how disabling it restores the expected one‑RTT performance while highlighting the interplay between TLS and lower‑layer protocols.
This guide explains why Charles combined with Postern is preferred for Android app packet capture, details the required environment, step‑by‑step configuration of Charles and Postern, SSL proxy setup, certificate installation and migration, and compares the solution with Fiddler.
netcap is an open‑source eBPF‑driven kernel network packet capture tool that extends tcpdump syntax to trace skb‑related functions across the Linux network stack, offering detailed packet tracing, customizable filters, multi‑trace aggregation, and user‑defined output to improve debugging of packet loss and performance issues.
This article explains why packets are dropped in Linux, introduces the kfree_skb_reason API added in kernel 5.17, and shows step‑by‑step how to use bpftrace to capture drop reasons, five‑tuple details, and stack traces for precise network debugging.
An in‑depth post‑mortem of a recurring midnight kernel panic caused by a malformed sk_buff structure, detailing how vmcore analysis, packet inspection, and netfilter hook tracing pinpointed a third‑party module bug in Linux 5.10, and outlining remediation steps.
The article walks through a real‑world case where an app’s content fails to load due to MTU/MSS mismatches, explains how packet‑capture analysis reveals the problem, demonstrates ping‑based MTU testing, and shows how oversized API parameters triggered the failure.
This article walks through a real‑world case where an app’s content loading fails due to MTU/MSS mismatches, explains how packet captures reveal retransmissions and missing ACKs, demonstrates ping‑based MTU probing, and shows how oversized request parameters in a new version caused the issue.
The investigation used Wireshark captures to uncover that a new app version sent oversized TCP segments—due to altered MSS and path‑MTU mismatch—causing unacknowledged retransmissions, which were diagnosed with ping‑do‑not‑fragment tests and resolved by trimming the request parameters and confirming via TLS key logging.
The article introduces xcap, an eBPF‑based next‑generation kernel network packet capture tool that overcomes the limitations of traditional utilities like tcpdump by providing flexible hook points, customizable filtering, and support for diverse network scenarios such as AF_XDP and DPDK, thereby dramatically improving packet‑loss debugging efficiency.
This article investigates a rare TCP four‑handshake disorder where out‑of‑order FIN and ACK packets cause a server to wait for a timeout before closing, detailing packet captures, kernel code analysis, eBPF monitoring, and the discovery that the shutdown() call versus close() triggers the issue.
This guide explains how to test and debug Linux network ports using telnet, netcat (nc), and netstat, covering command syntax, interpreting connection results, sending and receiving data, exiting the tools, and handling environment limitations on embedded systems.
This guide explains why dual-machine debugging is needed, outlines the two main scenarios (virtual machine and physical machine), and provides step‑by‑step instructions for configuring VirtualKD as well as network‑based kernel debugging on Windows systems, including common test cases and useful commands.
This guide explains how to verify TCP port connectivity on Linux using telnet and nc, shows how to interpret their output for open or closed ports, describes ways to exit these tools, and demonstrates how netstat can confirm the connection state and identify the owning process.
This article explains how to diagnose low network throughput by examining sender, receiver, and intermediate bottlenecks, understanding TCP flow and congestion windows (rwnd and cwnd), using Linux ss commands, and interpreting Wireshark visualizations to pinpoint the root cause.
nettrace is an eBPF‑powered command‑line utility that traces a packet’s full kernel lifecycle, diagnoses network faults with a built‑in knowledge base, monitors anomalies and skb drops, supports NAT, GRE, IPVS and netfilter hooks, and replaces legacy tools like tcpdump and droptrace in cloud‑native Linux environments.
This article introduces AndroidMonitor, a lightweight Android packet‑capture library, explains how to add its monitor and monitor‑plugin dependencies, configure ProGuard, customize entry names, ports and logos, and optionally use AndroidLocalService to expose captured data via a local socket for both mobile and PC UI visualization.
This article analyzes why an iOS SSO QR‑code login sometimes fails with a 404 error despite being on company Wi‑Fi, explains the 301 redirect caused by network restrictions, and provides a step‑by‑step solution using NSURLCache inspection and cache‑clearing techniques.
This guide explains why TCP throughput may fall short of network capacity, covering sender, receiver, and network bottlenecks, how to read receiver window (rwnd) and congestion window (cwnd) values on Linux, and how to interpret Wireshark graphs to pinpoint the root cause.
This article explains why network throughput may fall short of the link capacity, describes the three typical bottlenecks (sender, receiver, and intermediate network), and provides practical methods to examine TCP window sizes, congestion control variables, and Wireshark visualizations for pinpointing the root cause.
This article explains the end‑to‑end journey of a data packet in a TCP‑based chat application, identifies multiple points where packet loss can occur—from connection handshake to NIC queues—and offers practical Linux commands for diagnosing and mitigating these losses.
Learn how to configure Charles and the Postern VPN tool to intercept Android app traffic, including environment setup, proxy configuration, SSL certificate handling, and a comparison with Fiddler, enabling reliable packet capture even when apps disable proxy settings.
The article explains Whistle, a Node.js‑based cross‑platform HTTP proxy, by first showing a simple proxy implementation and then detailing its full architecture—five core modules for request entry, tunneling, processing, rule management, and plugin handling—along with its extensible, isolated plugin system.
This article explains Whistle's architecture and core concepts, walks through building a simple Node.js HTTP proxy, details its five‑module design, rule and plugin management, and provides code examples for creating a full‑featured web traffic debugging tool.
This article explains the low‑level mechanisms by which tcpdump intercepts network packets in the Linux kernel, covering both the receive and transmit paths, the interaction with netfilter, and the steps required to implement a custom packet‑sniffing program.
This article explains the internal mechanisms of tcpdump, showing how it registers a virtual protocol in the kernel's ptype_all list to intercept packets during both receive and transmit paths, how netfilter interacts with these paths, and provides guidance for building a custom packet‑capture program.
This guide walks you through common online failures—from disk full and high CPU on servers to Java Tomcat hangs, MySQL deadlocks, slow queries, Redis memory alerts, and network connection issues—providing step‑by‑step troubleshooting methods and practical commands to quickly locate and resolve problems.
This guide explains how to use the versatile netcat (nc) command for checking occupied ports, scanning port ranges, testing TCP/UDP connections, retrieving HTTP headers, transferring files, and measuring network throughput, complete with practical examples and useful options.
This article explains the challenges of iOS network request debugging, reviews existing external and in‑app tools, dives into the URL loading system and URLProtocol mechanics, and presents a delegate‑proxy solution that captures all traffic without altering the original requests, even in production environments.
This guide explains the Linux packet‑receiving process, shows how to identify where UDP drops occur, and provides practical commands and kernel tuning tips to troubleshoot network‑card, driver, system, and application‑level packet loss.
This guide compares five popular packet‑capture tools—Wireshark, Tcpdump, Charles, and mitmproxy—explaining their strengths, weaknesses, installation steps, filter syntax, and best‑use scenarios for developers and testers needing efficient network debugging.
A detailed investigation shows that an unexpectedly high 39 ms latency in a simple HTTP request is caused by TCP's Nagle algorithm and delayed ACK interactions, and demonstrates how enabling TCP_NODELAY or adjusting ACK timers reduces the delay to under 3 ms.
This guide explains how to install Charles, configure an iPhone proxy, capture HTTP/HTTPS traffic, set breakpoints, modify requests, repeat calls, and simulate network conditions, providing a comprehensive workflow for iOS network debugging and performance testing.
This guide explains how to configure Fiddler for capturing HTTPS traffic from mobile devices, install and trust its certificate on iPhone, and leverage features such as request inspection, saving sessions, replaying, mock responses with AutoResponder, and setting global or per‑request breakpoints.
This article investigates an intermittent timeout issue caused by a Java Apache HttpClient implementation that leaks connections, explains why numerous RST packets appear during TLS shutdown, and presents experiments and code revisions that clarify the TCP/TLS interaction and proper resource handling.
This guide explains how to set up the development environment, create a C# class‑library project, add Fiddler references, implement required interfaces, enable debugging, and build a custom Fiddler plugin that automatically decrypts encrypted SDK HTTP requests and displays them in clear text for testing.
