When an outgoing packet is captured by tcpdump, will it 100% be sent out, and not be dropped by kernel? Does tcpdump intercept on packet delivering path before or after kernel does any/all filtering work?
My question comes from such a case I met: I set socket timeout to a short time, and the tcp handshaking timeoutted right at the first SYN. Running tcpdump on both sender and receiver side, the only result I found was the sender side generated one SYN. The receiver side tcpdump got nothing.
Does it infer the packet is dropped by nic, switch or router, not the kernel itself?