diff --git a/hosts/FredOS-Mediaserver.nix b/hosts/FredOS-Mediaserver.nix
index 0559e3d..feb1d35 100644
--- a/hosts/FredOS-Mediaserver.nix
+++ b/hosts/FredOS-Mediaserver.nix
@@ -11,6 +11,12 @@
       mergerfs
       wget
       util-linux
+      # This host is the router (services/router.nix) but shipped without any
+      # way to see a packet, so "is that nftables rule actually matching?" was
+      # unanswerable. Counters tell you a rule fired; these tell you what it
+      # fired on.
+      tcpdump
+      conntrack-tools
       javaPackages.compiler.temurin-bin.jre-25
       unzip
       screen