I've found the log-collection function on CPPM to be very helpful - specifically the fact that it will include a packet capture.
The collection gives you the incoming request (if it gets to CPPM) and the decision making process followed by the outgoing reply if you get the timing right.