Reading tcpdump lightly
tcpdump is easier when the first filter is narrow. I start with a host and a port, then widen only if the conversation is missing.
One conversation at a time
A full capture of a busy interface is a wall of numbers. Pair the two addresses you care about. Watch the handshake, the first data, and the close. Time gaps often explain more than the flags do.
Headers first
Length, sequence, and the few flags on each line are enough for most questions. Payload comes later, and only when the headers cannot answer why a retry appeared.
Write the question down
Before I run a capture I write one sentence: which host stalled, and after which request. The dump then has a job. Without that sentence I keep scrolling.