Linux Networking Part 4: Reading tcpdump
Counters tell you that something is wrong. tcpdump tells you what happened. Most engineers can start a capture. Far fewer can look at forty lines of output and say "
Counters tell you that something is wrong. tcpdump tells you what happened. Most engineers can start a capture. Far fewer can look at forty lines of output and say "
"We're seeing packet loss." That sentence starts more wasted investigations than any other in infrastructure. It's not a diagnosis. It's a feeling.
You have nginx running. Someone says it's broken. You need to know, in the next thirty seconds: who is connected, from where, to which port, and whether anything
Most engineers learn Linux networking backwards. They memorise commands first, then spend years never quite knowing which one to reach for. So they run netstat -an, stare at 4000 lines,
Somebody says "the app can't reach the database." You have a terminal and no idea where to start. This post is the on-ramp. Vocabulary, then
Worker processes, worker_connections, file descriptors, and the two kernel queues in front of them - plus the order to check things in when someone says nginx is slow.
You know the feeling. ps aux scrolls past. Something is listening on port 5000 and you have no idea what put it there. You start the ritual: lsof -i :5000,
Grammarly is a privacy nightmare. LanguageTool needs 16GB of data. Harper is the offline grammar checker nobody talks about enough — and it belongs in your editor.
Most file transfer tools need SSH access or open ports. croc needs neither. Send files between any two machines with a code phrase and end-to-end encryption.
Most self-hosted deployment tools replace one form of complexity with another. You trade cloud bills for YAML sprawl, Dockerfiles, pipeline configs, and a weekend of docs hunting. Openship is
DocuSign charges $40/month. DocuSeal gives you the same core workflow in a Docker container that costs you nothing.
AI coding agents occasionally run catastrophic commands. dcg is a Rust-powered hook that intercepts destructive shell and git commands before they execute — sub-millisecond, context-aware, and worth five minutes of setup.