Reading packet captures requires understanding protocol behavior. Look for patterns that indicate problems.
TCP handshake issues:
- SYN sent but no SYN-ACK: firewall blocking or server down
- RST in response to SYN: port closed or blocked
Performance problems:
- Retransmissions: packet loss
- Duplicate ACKs: receiver missing packets
- Zero window: receiver overwhelmed
What to look for:
Follow the conversation from start to finish
Note timing between packets
Check for error responses
Look for unexpected RST or FIN packets