When the failure is reported by a specific user while all other users are working fine, capture the packet as close as possible to the affected user. If the failure is reported for multiple users, capture the packet as close as possible to the server.