I simulated a Denial-of-Service attack by connecting two virtual machines, i.e. attack and victim machine. The attack machine sends lots of traffic (http) against the victim machine running an application (web server).
I run tshark at the victim. At the end of a monitoring session, I see a tshark message indicating that some packets were dropped.
How do I know who dropped the packet: tshark, the application (web server), or the machine (in this case Ubuntu), or any other resource I haven't thought of? What sort of tests can I perform to verify that?