Observe the layers
A capture preserves clues from one observation point.
A packet analyzer can show a frame, packet, or segment as it appeared at a capture point. Header fields can reveal source and destination addresses, ports, flags, protocol identifiers, and timing.
Encrypted payloads may remain unreadable even when their transport and connection metadata are visible. A capture also cannot show traffic that never crossed the interface where it was recorded.
Follow the exchange
A conversation is a sequence, not a single packet.
To follow one transport flow, match its observed endpoints, protocol, and ports, then read the packets in time order. Sequence and acknowledgement numbers help show which data was sent and confirmed.
A repeated sequence number or a gap followed by a later retransmission can be evidence of loss or reordering, but the capture point matters. A capture near one endpoint cannot by itself prove what happened on the other side of the path.
Build the model
Four capture fields
Addresses
Identify the observed source and destination at a protocol layer.
Ports
Connect transport traffic to a service endpoint or conversation.
Flags
Show control signals such as connection setup or acknowledgement.
Timing
Compare packet order, spacing, and response delay.
Mini investigation
Read a packet
Select the field you want to inspect in an observed TCP (Transmission Control Protocol) exchange.
Source port 51514 and destination port 443 identify the observed client-to-service conversation.
Ports provide context about the transport conversation, not the user's full intent.
Knowledge check
Test your capture model
Answer eight questions. The answer order changes each time.