A CloudOps engineer is troubleshooting intermittent connection failures between an application server in a private subnet and an Amazon RDS database in another private subnet within the same VPC. The security groups appear correctly configured to allow the database port. The engineer needs to determine whether traffic is actually reaching the database subnet and identify exactly where packets are being dropped, including which rule set is rejecting them. Which action provides the most direct visibility into the accepted and rejected traffic at the network interface level?