Your browser said “loading.” What actually happened?

The governing idea

Every claim needs a vantage point.

A vantage point is the machine or network boundary where you collected evidence. Running skbx on your laptop proves what the packet did inside that laptop. It does not grant visibility into your ISP or a third-party server. Add skbx to a Linux gateway or target host and each becomes another provable boundary.

Turn a hostname into one controlled destination.

A website name may resolve to several IPv4 and IPv6 addresses, often at a CDN or anycast edge rather than the origin server. Choose one IPv4 address for this experiment, then ask Linux which gateway, interface, and source address it would use.

TARGET_HOST=example.com
TARGET_IP=$(getent ahostsv4 "$TARGET_HOST" | awk 'NR == 1 {print $1}')
printf 'target=%s ip=%s\n' "$TARGET_HOST" "$TARGET_IP"
ip route get "$TARGET_IP"

via

Your next-hop gateway—not “the ISP.”

dev

The local interface Linux selected.

src

The local source address before upstream NAT.

target IP

The edge selected for this run; a later lookup may differ.

Record request egress and response ingress.

Check privilege and kernel prerequisites first. Then resolve the exact probes without attaching. These functions cover IPv4 local output, device queueing, IPv4 receive, and TCP receive on a typical host; the plan tells you what your target kernel actually exposes.

skbx doctor --json

skbx plan \
  --probe ip_local_out \
  --probe ip_output \
  --probe __dev_queue_xmit \
  --probe ip_rcv \
  --probe tcp_v4_rcv \
  --json

Start a bounded capture in terminal A. Keep the pcap expression pinned to the address from step 01 so unrelated browser tabs do not contaminate the evidence.

sudo skbx capture \
  --probe ip_local_out \
  --probe ip_output \
  --probe __dev_queue_xmit \
  --probe ip_rcv \
  --probe tcp_v4_rcv \
  --filter-track-skb \
  --duration 15 \
  --ready-file /tmp/skbx-web.ready \
  --output web-trace.jsonl \
  "host $TARGET_IP and tcp port 443"

Make one request to the exact IP you traced.

When terminal A reports that the ready file exists, use --resolve in terminal B. It keeps the original hostname for TLS and HTTP while forcing curl to use the chosen address. HTTP/1.1 makes this a deterministic TCP 443 experiment; a browser may instead reuse a connection or choose HTTP/3 over QUIC and UDP.

test -e /tmp/skbx-web.ready && \
curl --http1.1 \
  --resolve "$TARGET_HOST:443:$TARGET_IP" \
  -sS -o /dev/null \
  -w $'remote_ip=%{remote_ip}\ndns=%{time_namelookup}s\nconnect=%{time_connect}s\ntls=%{time_appconnect}s\nttfb=%{time_starttransfer}s\ntotal=%{time_total}s\nhttp=%{http_code}\n' \
  "https://$TARGET_HOST/"

These values are cumulative from curl’s start. Subtract adjacent values to estimate each phase; do not label all time before the first byte “ISP latency.”

tail -n 1 web-trace.jsonl | jq .
skbx replay web-trace.jsonl --format json

Probe transit. Do not promote it to proof.

tracepath asks routers along the path to reveal themselves and can discover path MTU. mtr repeats hop probes to show how responses vary. Either may encounter silent or rate-limited routers, asymmetric routes, tunnels, or anycast edges.

tracepath -n "$TARGET_IP"
mtr --report --report-cycles 20 "$TARGET_IP"

Instrument the far end—if it is yours.

A third-party website is an evidence boundary: you cannot run skbx there. If you control the server or CDN-facing Linux edge, synchronize its clock, begin a second bounded capture, then make the same curl --resolve request from the client.

sudo skbx capture \
  --probe ip_rcv \
  --probe ip_local_deliver \
  --probe tcp_v4_rcv \
  --probe tcp_v4_do_rcv \
  --filter-track-skb \
  --timestamp absolute \
  --duration 20 \
  --output target-trace.jsonl \
  "host <CLIENT_PUBLIC_IP> and tcp port 443"

The target usually sees the public address after NAT, not your laptop’s private source address. Correlate the two captures with timestamps, protocol, ports, addresses as seen at each boundary, and request timing. event: and route: handles are stable within their own capture; they are not shared identifiers across machines.

Convert two traces into a smaller search space.

Know what each party can see.

A browser can reuse connections, race IPv4 against IPv6, consult encrypted DNS, use a proxy or VPN, and choose HTTP/3 over QUIC. This recipe deliberately removes those variables. To investigate the browser itself, first identify its actual target address and transport, then adapt the filter to TCP or UDP port 443.

Continue the investigation

Change one variable at a time.

Repeat the controlled request against another resolved address, network, protocol, or gateway vantage. Preserve every native trace and its reliability footer. Once the broad boundary is known, use the packet-drop guide to deepen the Linux-side probe plan without inventing events between hosts.