When troubleshooting issues like this, always look at server logs also. Looks like this was an authentication-related issue due to the absence of cookies, and the server will have logged it as such. You really can't tell much from TCPDUMP.
Yes, this is good advice, when you have access to it.
In this case, the handler fonctions were exactly what I needed: to know what is being sent and received as tcpdump misses al lot of data as you pointed out.
If you have access to it wireshark is more intelligent about "common" protocols and can give you a protocol-level dump rather than just stopping at the TCP layer (presuming you're not hitting something over https; but even then I believe that there's ways to proxy around that or use the server's key if you control / have access to that).
The cake is a lie.
The cake is a lie.
The cake is a lie.