Lesson 8 of 8 · 30 minutes

Troubleshoot a network conversation

Bring the course together: read a supplied trace, locate the failed stage, and write a conclusion supported by evidence.

What you will learn

  • Separate DNS, transport, and application results in a trace.
  • Calculate response intervals from timestamps.
  • Choose a follow-up check that tests competing explanations.

Reconstruct the exchange and defend your conclusion

For a typical TCP connection, look for client SYN, server SYN/ACK, and client ACK before application data. Sequence numbers track bytes and acknowledgements identify the next expected byte. Wireshark often presents relative sequence numbers to make them easier to read. A successful handshake supports transport connectivity at that moment; it does not prove that authentication, TLS negotiation, or the application succeeded. UDP has no equivalent transport handshake, so correlate requests and responses using application fields and timing.

Follow the dependencies in order. A client may obtain configuration through DHCP, resolve a local next hop through ARP, ask DNS for a service address, and then contact the service. Cached information means not every step appears in every capture. DNS response codes, ICMP errors, TCP resets, and application status codes answer different questions. A reset ends or rejects a connection; its presence alone does not identify the process or middlebox responsible.

Repeated SYNs with no visible SYN/ACK suggest an unanswered connection attempt at this capture point. They do not establish whether a firewall dropped the traffic, the server was unavailable, or the capture missed replies. Retransmissions can accompany loss or delay, while capture gaps and reordering can complicate their interpretation. A zero receive window indicates that the receiver is advertising no space for more data at that time. Compare timing and both directions before assigning a bottleneck.

Security analysis uses the same evidence discipline. Attempts to many ports, repeated periodic connections, or unexpectedly large outbound transfers may justify investigation, but can also have legitimate explanations. Establish a baseline, identify the owning process and asset, and correlate endpoint, DNS, proxy, or firewall records. Write down the observation, possible explanations, confidence, visibility limits, and the next check that could distinguish them.

Use the synthetic trace below as a paper lab. Times are seconds from capture start. No packet file is needed: the rows are deliberately simplified observations, not Wireshark output. The documentation addresses and portal.example name are illustrative. First identify the DNS query and answer, then pair the two TCP attempts with their destination, and finally locate the transport handshake and application response.

Keep these points in mind

  • The capture point and collection settings determine what missing traffic can mean.
  • Capture filters discard traffic before recording; display filters only narrow the visible view.
  • Check name resolution, transport, and application behaviour separately.
  • A packet pattern supports a hypothesis; corroborating evidence establishes a stronger conclusion.
  • Preserve packet references, timing, uncertainty, and the next investigative step in your report.

Pause and practise

Using the paper lab, write a short incident note: (1) Did DNS answer, and how long did it take? (2) Which packets show the first failed attempt and the later successful handshake? (3) How long elapsed from the second SYN to SYN/ACK, and from HTTP request to response? (4) Give a display filter for this client’s TCP port 80 traffic. (5) State two possible explanations for the first attempt and one check that would distinguish them. Finally, explain whether these rows prove an attack or complete page loading.

Show a worked response

Packets 1–2 show an A-record answer in 20 ms. Packets 3–5 show repeated SYNs from port 51000 without a visible reply; packets 6–8 complete a new handshake from port 51001. The second SYN receives SYN/ACK after 40 ms. Packets 9–10 show an HTTP 200 response 100 ms after the request; that interval includes network and service time, not just server processing. Use ip.addr == 192.0.2.10 && tcp.port == 80, clearing it when checking DNS. Transient filtering or loss, server unavailability, and incomplete capture visibility remain possible explanations for the first attempt. Compare a simultaneous server-side capture and firewall records: did the initial SYNs arrive, and did replies leave? Check capture drops and return-path coverage too. The evidence supports an initially unanswered TCP attempt followed by a successful connection and HTTP response. It proves neither an attack nor that every page resource loaded.

Check your understanding

Choose the best response to each scenario, then check your reasoning. These are course practice questions.

1. The first TCP attempt has repeated SYNs and no visible reply. What is the best next step?

0 of 1 answered

Review course →
← Previous lesson