A packet capture on a bank laptop shows the TCP SYN for an internal app is not leaving the host, while other laptops that use the same gateway succeed. Where should diagnosis start?
Select an answer to reveal the explanation.
Short Explanation
If your letter is still sitting on the desk, you do not start by repaving the highway. You start with that laptop's local stack or the gateway configured on it, because the SYN is not leaving the host. Other laptops on the same gateway already show the far path can carry their sessions.
Full Explanation
The capture on this laptop shows the TCP SYN for the internal app is not leaving the host. A segment that is never transmitted has not reached the WAN, a remote prefix, or the data center, so diagnosis starts on the laptop's local stack or the default gateway configured on that host. Other laptops using the same gateway succeed, which shows the shared network can carry their SYNs and points back at this host's own stack or its own gateway setting. Replacing the WAN circuit those healthy laptops already use changes a path this SYN has not entered. A BGP alert for the application prefix watches routing to a destination the other laptops already reach, and it cannot explain a SYN that never leaves the failing host. Moving a data-center Enterprise Agent closer to the application relocates a probe and does not make this laptop emit the SYN. Exam caveat: once a capture shows the SYN is not transmitted, upstream circuit and routing work is premature until the host is actually sending. Operational check: repeat the capture on the failing laptop and on a healthy peer, and confirm only the failing host fails to emit the SYN toward its configured gateway.