Packet capture turns TCP from a textbook into observable state. A good analysis tracks the five-tuple, handshake, sequence/acknowledgement numbers, window advertisements, retransmissions, round-trip timing and connection teardown. The goal is to reconstruct the story the endpoints are telling each other.
Remember the shape, not the sentence
“Treat the capture like a security camera recording a conversation. Do not stare at packets independently; reconstruct the timeline and infer state transitions.”
Start with identity
Filter on the TCP flow's source/destination IPs and ports. The five-tuple identifies a flow sufficiently for most capture analysis.
Read sequence and ACK progression
Check whether sequence numbers advance as expected and whether acknowledgements progress. Duplicate ACKs, retransmissions and gaps often reveal loss.
Separate transport and application symptoms
A slow HTTP response could be server processing, DNS, TCP retransmission, TLS negotiation or congestion. Capture evidence helps isolate the phase.
See the mechanism before you memorize it
One diagram, one causal story, one reconstruction task.
Analyze a TCP stream in a packet capture — causal map
Filter
Find one TCP conversation using a five-tuple filter.
Handshake
Confirm SYN, SYN-ACK, ACK and option negotiation.
Data
Track sequence and acknowledgement progression.
Loss
Look for retransmissions, duplicate ACKs or timing gaps.
Draw the idea yourself
Rebuild the core flow on a real canvas before moving to the worked walkthrough.
Walk the system
Filter
Find one TCP conversation using a five-tuple filter.
Handshake
Confirm SYN, SYN-ACK, ACK and option negotiation.
Data
Track sequence and acknowledgement progression.
Loss
Look for retransmissions, duplicate ACKs or timing gaps.
Close
Inspect FIN/ACK or RST behavior and relate it to application completion.
Useful Wireshark display filters
Start narrow. One stream tells a coherent story; the full capture contains too many unrelated conversations for fast reasoning.
tcp.stream == 0
tcp.flags.syn == 1
tcp.analysis.retransmission
tcp.analysis.duplicate_ack
tcp.port == 443What usually goes wrong
Close the tab. Rebuild it from memory.
Read the question, answer aloud, then reveal.
What is a five-tuple?Reveal answer
Protocol plus source IP, source port, destination IP and destination port, commonly used to identify a transport flow.
What does a retransmission mean?Reveal answer
The sender sent data again because delivery was not considered successfully acknowledged within the transport's reliability logic. The root cause still needs investigation.
Why filter to one tcp.stream?Reveal answer
It converts a noisy packet capture into a single ordered conversation that is much easier to interpret.
Make this idea travel.
Connect it next to: dns • http-versions • wireshark.