One explicit rule turned 25 Nmap SYN probes into 17 eve.json alerts; an empty rule file gave none with the same capture. Follow one alert to its packet and see why an ordinary recovery request also matched.
One 79-packet capture gave Zeek 29 connection records (24 REJ, 4 SF, 1 RSTO), two DNS records with one NXDOMAIN and two HTTP records. Follow the uid from DNS to HTTP and check each record against the packets.
One signed answer over UDP, TCP, DoT and DoH. A wrong certificate hostname stopped DoT, a wrong DoH path returned HTTP 404, and a broken parent DS still arrived over verified TLS while DNSSEC validation rejected it.
dig kept returning 203.0.113.42 with an RRSIG after one hex digit in the parent DS changed. delv reported broken trust chain at the DS-to-DNSKEY match. An unsigned sibling validated as insecure, which is a different result from bogus.
The client printed Verification: OK and still got no HTTP 200. Three mTLS faults: no client certificate, a client signed by the wrong CA (alert 48, unknown ca) and a server-only certificate (alert 43). The server log named each one.
Same address, three faults. Without SNI the server picked its fallback certificate; the wrong expected name failed the hostname check; an untrusted root and a missing intermediate gave the same error at depth 1 and depth 0.
Small pings and HTTP passed, but a 64 KiB IPv6 upload timed out behind a 1280-byte link because the router dropped its own Packet Too Big messages. Restoring them fixed it, and a cached PMTU made a later blocked test pass anyway.
The SYN was in tcpdump, the socket was listening and nftables accepted everything, yet the connection timed out. Strict rp_filter rejected the source because the best return route used another interface. Fix the route and keep strict mode.
An open port is not a working connection. A missing client route gave Network is unreachable, a stopped listener returned a reset, a loopback-only bind left no socket on the server address, and a later nftables chain dropped the SYN after an allow.
After the SNAT rule was removed and restored, an open session kept working, a fresh source port worked, but one retry still timed out. Its conntrack entry was SYN_SENT [UNREPLIED] with no translation. Delete that one entry, not the table.
The allow counter increased and the client still timed out. nft monitor trace followed one SYN through an accept in the first forward chain and a drop in a later one; captures showed it on ingress and never on egress.
Ping worked and ip neigh showed one row, yet two hosts answered ARP for the same IP. Capture both replies with arping, see why DAD mode returned 1 even on a healthy address, repair the duplicate, and tell proxy ARP apart.