One Flow, Four Boundaries: Finding the Last Packet

One side says it sent the traffic; the other says it arrived nowhere. That pair of statements sounds like a contradiction and is usually just two different measurements. A packet count, a firewall log and a capture describe different layers, and comparing them without labels produces a suspect rather than a location. Build the report around one flow and its observation points.

A Counter Without Context Proves Little

A gateway reporting bytes out is not evidence that the far end received a specific request. The counter may include other flows, other times or another layer of encapsulation. A counter that rises while a destination sees nothing may still be correct, because it measured a different question. Before comparing anything, fix the flow, the window and the layer.

Two numbers from different layers can disagree honestly. The disagreement is the beginning of the investigation, not the conclusion.

Label Every Observation Point

For each observation, record the device, the interface or hook, the direction, the clock reference and whether it shows inner traffic or the outer transport. A firewall log on the host and a capture on the uplink are different evidence even when they are seconds apart. The label is what lets another engineer reproduce the view.

Keep the clock problem visible. Clocks drift, and a timestamp taken on one host may not be directly comparable with another. If the hosts cannot be synchronized, bracket the attempt with timestamps from both and use the ordering rather than the absolute value. Note the offset you measured rather than silently adjusting times.

Match the Fields the Point Actually Exposes

Compare addresses and protocol fields at points that actually expose them. Account for deliberate translation, because a rewritten tuple is still the same conversation. For an authorized IPv4 Echo test, the RFC 792 definition gives identifier and sequence fields that help match requests and replies. Keep the addresses and the window too, since a sequence value alone is not a unique identity.

tcpdump -ni eth0 -c 20 'host 198.51.100.20 and icmp'
tcpdump -ni tun0 -c 20 'host 10.90.0.5 and tcp port 443'

Where the outer leg is encrypted, keep the peer conversation and its direction in a separate record. The inner Echo identifier should not be expected to survive in the same shape outside. Outer and inner counts must not be compared without stating the representation.

Report the Missing Interval, Not a Suspect

A missing observation is bounded evidence, not proof of a drop at that device. Filters, capture placement, dropped capture data and a window that missed the attempt all produce an incomplete record. Say what is missing and between which boundaries. An absence also needs an expiry, so state how long you observed and what would have had to appear.

A claim from the other side that it forwarded traffic is context, never an observation. Hand over the flow, the timestamps, the labelled boundaries and one narrow example. Keep the report short enough that the requested observation stands out. That turns the next request into a precise measurement instead of an accusation.

Put the requested measurement in one sentence. Then stop writing.