A packet capture is a view from one point on the network. Before opening a suspicious packet, check where the capture was taken, its timestamp range, snap length, filters, and whether the interface dropped packets. That context often explains the odd gap you were about to blame on an endpoint.
Then work upward. Confirm the link type and direction. Check IP addresses, fragmentation, and protocol. For TCP, inspect ports, flags, sequence numbers, acknowledgments, and retransmissions. Only then follow the application conversation. Wireshark’s packet-range guide explains the difference between packets captured and packets shown by a display filter.
A TCP packet is not the same thing as an application message. Segmentation and reassembly split and join data; acknowledgments carry sequence information; retransmissions may put bytes on the wire again. RFC 9293 is the reference for the transport behavior underneath the application exchange.
A compact first pass:
- Record the capture point, interface, filters, timestamp range, and file format.
- Find the conversation and inspect both directions.
- Check whether setup and teardown are present.
- Follow the stream after confirming the endpoints and sequence behavior.
- Save the filters used and preserve the original capture.
- Redact credentials, cookies, addresses, and payloads before sharing an example.
A missing packet has several possible explanations: filter, drop, capture point, offload, or no transmission. One trace can narrow the field; a second observation point or endpoint log can settle it.