To me, this is a pure networking question. "How to find where in the traffic flow the RST is happening" is resolved by networking techniques. The fact that the experiment is about TLS and involves the manipulating of the SNI seems secondary. Which means the primary issue is the network flow.
However, there might be some utility in having this particular experiment (and resulting tests) on our site.
I'm happy to get your feedback and reasonings.