Resolve a name
DNS maps names to records. An A record contains an IPv4 address, while an AAAA record contains an IPv6 address. A client generally asks a configured resolver, which can answer from cache or consult other DNS servers. Match transaction ID, question, endpoints, and timing when pairing a conventional DNS query and response.
Classic DNS uses UDP or TCP port 53; encrypted DNS can use other transports and hide questions from a simple packet inspection. Cached answers mean a fresh browser request need not produce a DNS query. A negative answer such as NXDOMAIN differs from no visible answer: one is an application response, the other is an observation gap or unanswered request.
Connect, request, respond
After resolving an address, a client contacts the service. In a simple cleartext HTTP example, a GET requests a resource and a response includes a status code. A 200 response indicates a successful HTTP result for that request; a 404 says the requested resource was not found. One response does not prove that every resource on a page loaded.
DNS success, transport success, and application success are separate checkpoints. If DNS returned an address but the destination never responds to a TCP SYN, focus on transport reachability and capture coverage before blaming the requested web path.
Encrypted content still has context
HTTPS protects HTTP using TLS. A network capture without suitable authorised decryption material generally cannot reveal the request path, credentials, or response body. Following a stream groups traffic; it does not automatically remove encryption. Do not promise to recover plaintext just because packets were saved.
Addresses, timing, sizes, transport state, and some handshake information may still help. Use client and server logs to answer questions about encrypted application content. Metadata itself can be sensitive, so use approved captures and limit sharing.