Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Stop wondering if your packets are hitting the firewall or the app

🧩 The Challenge

You’ve got a service that’s totally unreachable, and you’re stuck playing the guessing game of whether your firewall is silently dropping traffic or if the app is just dead. I’ve wasted half an afternoon tracing iptables chains only to find out the app wasn’t even listening on the right interface.

💡 The Fix

Use the –packet-info flag with ss to see the exact state of your socket buffers and drop counters without needing a full tcpdump. It’s the fastest way to confirm if your kernel is tossing your packets into the void.

ss -tnmi '( dport = :80 or dport = :443 )'

⚙️ Why It Works

This command forces the kernel to dump the congestion window and retransmission stats for every connection matching those ports. Seeing those retransmission counters climb tells you immediately that the handshake is failing before the app even sees a byte of data.

🚀 Pro-Tip: Pipe it into column -t if you want to actually read the output without squinting.

Linux Tips & Tricks | © ngelinux.com | 11/4/2026