The problem

You run curl http://example.org/ in a container and get 577 bytes of HTML back. tcpdump in the same container counts 12 packets for that one call. The packet that carries the request is 141 bytes long, and only 75 of them are the GET that curl wrote.

The other 66 bytes are three headers, one per layer: 32 bytes of TCP, 20 bytes of IP and 14 bytes of Ethernet. A router reads the IP header and rebuilds the Ethernet header at every hop. The server reads the TCP ports to find the web server's connection.

A failed request often stops in one of these headers. An IP address nobody answers ARP for is day 4, an address with no route is day 3, and a port with nothing listening is day 5.