Packet capture beats ping for finding slowness

Users report slowness. ping is a healthy 150 ms and mtr shows no loss. Look at TCP instead.

tcpdump -i eth0 -s 0 -w /tmp/cap.pcap 'tcp port 443 and host 1.2.3.4'
tshark -r /tmp/cap.pcap -q -z io,stat,1,"COUNT(tcp.analysis.retransmission)tcp.analysis.retransmission"

A retransmission rate above one percent can halve single-flow throughput, and ping will never show it — ICMP is tiny and does not move the congestion window.

Out-of-order delivery matters too. A high tcp.analysis.out_of_order count usually means a load balancer is splitting the path, and reassembly costs about what loss costs. Work out which direction before changing routes or congestion control.