Why packet captures end arguments

Most network troubleshooting starts with symptoms: "the site is slow", "the API sometimes times out", "video calls freeze". Symptoms are vague, and they invite guesses. A packet capture records the actual conversation between machines, with timestamps accurate to microseconds. It replaces opinions with evidence.

What a capture can show

• Whether a request actually left the client and reached the server.
• How long DNS resolution took, and which server answered.
• Whether the TCP handshake completed, and how long it took.
• Whether packets were lost and retransmitted.
• Whether a TLS handshake failed, and at which step.
• How long the server took between receiving a request and sending the first byte of its response.

These facts often point clearly at one part of the system. If the server replies in 20 milliseconds but the client receives the response two seconds later, the problem is somewhere in between. If the server takes two seconds to send its first byte, the application is slow, not the network.

What a capture cannot show

• What happened inside an application, such as a slow database query.
• Encrypted content, unless you have the keys, though you can still see timing and sizes.
• Traffic on parts of the network you did not capture.

This is why where you capture matters as much as how. We return to this in the final section.

A simple mindset

Approach captures like an investigator:

1. Define the question: "Why does the login request take four seconds?"
2. Capture at the right place and time, ideally while reproducing the problem.
3. Filter down to the relevant conversation.
4. Read the timeline and look for gaps, errors and retries.
5. Form a hypothesis and check it against more evidence.
6. Write it up with screenshots and timestamps.

Wireshark and friends

Wireshark is the most widely used packet analyser. It is free, open source and decodes thousands of protocols. On servers without a graphical interface, tcpdump captures traffic to a file you can analyse in Wireshark later, and tshark, Wireshark's command line version, can filter and summarise captures in scripts.

Ethics first

Packet captures can contain passwords, personal messages and confidential data. Only capture traffic on networks and devices you own or are authorised to analyse, store captures securely and delete them when no longer needed. We discuss this properly at the end of the course, but it applies from your very first capture.