The point is, some days you have to drop down into tcpdump and pcap files to get the truth.
– Steve Souders while tracking down how much HTML5 video data iOS actually receives.
Turns out server logs were giving an incorrect picture of the amount of data that was being transmitted. It took watching individual packets to track down what was really happening. Go read the post for the odd twist at the end.
Reading this reminded me of using Wireshark to track down multiple packet issues in HTTP POST requests from XMLHttpRequest.