How passive HTTP capture on a Linux host works with AF_PACKET and a BPF filter, what it can and cannot see with TLS, and how to turn it into per-endpoint latency, error rates and a service map.