A service is seeing intermittent connection resets between two hosts. How would you use tcpdump to find out whether the RST is coming from the client, the server, or something in between?

Resets are directional, so a single capture point only tells you who received the RST, not who sent it. Run tcpdump on both hosts at the same time, filtered to the specific 5-tuple (source IP/port, dest IP/port, protocol) so the two captures are directly comparable, and use -tt for high-resolution timestamps so you can line up events across hosts (NTP-synced clocks matter here). If the RST shows up in the server-side capture as an outbound packet but never appears at all in an in-between capture point (a load balancer, NAT gateway, or firewall host), the reset is being generated downstream of the server and something in the path is tearing down the connection — commonly an idle-timeout on a stateful firewall/LB, a conntrack table eviction, or a security appliance resetting on a signature match.

Also check sequence and ACK numbers around the reset: a RST with a sequence number that does not match the expected next byte suggests a stale/duplicate connection (e.g., after a NAT device reused a source port) rather than an intentional application-level close. Cross-reference the reset timing against connection idle time — if resets cluster right around a round number like 60s, 300s, or 900s of inactivity, suspect an idle timeout on a middlebox rather than the two endpoints themselves.