Network tools become useful when the question is narrower than the output. “Scan the network” and “capture everything” produce noise, risk and sensitive data. Start with a failing source, destination, service and time window.

Establish scope and authority

Record the owner-approved IP range/hosts, allowed probe types and ports, source system, schedule, rate, retention and recipients. Confirm whether intrusion detection, fragile devices or third-party networks may be affected.

Packet captures can contain names, addresses, cookies, queries and application content. Use capture headers or the smallest payload length that answers the question; encrypt storage and delete under the agreed retention rule.

Understand the Linux vantage point

Before probing, inspect local state:

ip -brief address
ip route
ip neighbour
ss -lntup

Identify the interface and route the target will use. A capture on eth0 cannot show traffic routed through a VPN interface, and a switched endpoint normally sees its own unicast traffic—not every host on the VLAN.

Virtual bridges, containers, VLAN subinterfaces and network namespaces create additional capture points. Offload can make packet sizes/checksums look surprising on the sending host. Encryption exposes endpoints, timing and volume but not necessarily application content.

Separate discovery from port scanning

Nmap’s list scan can validate target expansion without sending normal discovery probes, although DNS lookup may still occur unless controlled. Host discovery with -sn identifies responding hosts without continuing to a port scan.

nmap -sL -n <approved-range>
nmap -sn <approved-range>

The official Nmap guide explains that discovery can use ICMP, TCP and local ARP/IPv6 neighbour discovery. Results depend on source privileges, network location and filtering. “Down” means no selected probe produced a qualifying response; it does not prove the address is unused.

Do not add -Pn casually: it skips host discovery and causes later scan stages to treat every target as online. Do not run default Nmap without understanding that it normally continues into port scanning.

Capture one flow

Use a capture filter that names the relevant host(s), protocol and port, a bounded packet count/file size and the correct interface. For example:

tcpdump -i <interface> -nn -s <snaplen> -c <count> -w <case>.pcap '<approved-filter>'

-nn avoids name/service lookup changing or obscuring evidence; -w preserves packets for controlled analysis. Choose snap length deliberately: headers may be sufficient for loss/handshake questions, while application diagnosis may require more and increase privacy exposure.

Start the capture before reproducing once, record exact times, then stop. Capture both ends only when authorised and necessary. A one-sided trace cannot always distinguish a packet lost in transit from a response that returned along another path.

Read packets as a conversation

For a TCP connection, locate name resolution first when a hostname is used, then the SYN/SYN-ACK/ACK handshake, TLS exchange and application request/response. Retransmission indicates missing acknowledgement from that vantage point; it does not prove which device dropped the packet.

For DNS, compare query name/type, selected resolver, response code, returned records and timing. For UDP, lack of response may be normal application behaviour or filtering; there is no TCP-style handshake.

Correlate packet time with application, firewall, server and client logs. Packet evidence shows what was visible at that point, not the internal reason a device made its decision.

Preserve and report safely

Name the capture with a case identifier rather than customer/user details. Record capture host, interface, clock source, filter, snap length, tool/version and hash. Keep the unmodified original restricted and analyse a copy.

Share extracted timestamps, flow summaries or redacted screenshots where they answer the question instead of distributing the full capture. Never upload a production capture to a public analysis service without explicit data authority.

Conclude with bounded language: which packet was observed or absent at which vantage point, and what further evidence would distinguish remaining causes. Discovery and capture are measurement tools, not verdict machines.