How did I write "Socket + XML = pitfall"?
Well, I kind of know the XML code inside out ;-), so I knew beforehand that a SAX parser closes the stream it reads. So I just mostly wrote a simple program to confirm the socket behavior. Also, I think I know about TCP probably more than average developers. That probably have helped, too.
Mostly I just verified that calling socket.getInputStream().close() brings down the whole connection. This you can quickly check by attempting to socket.getOutputStream().write(0); afterward. While no authoritative document was found on this issue, there's overwhelming side evidence to back up this hypothesis; for example, JDK added the partial close support only in 1.3. That must mean that any socket method that pre-date JDK 1.3 cannot possibly do partial close (or else why they needed to add it later?)
Ethereal could have been used. When I was studying TCP I used it a lot. But in this case, since I was just interested in if the connection was still alive, netstat would have been just fine.
I think most of the times I do tricky trouble-shooting by tracing into JDK and seeing the code in action by myself using a debugger. One thing I hate is that JDK core class libraries are compiled without the debug info. This is also done for a reason (to reduce the size of JRE), but one of those days I'll recompile everything in src.zip to create my custom rt.jar with full debug info!