Packet captures: streams, time, and reconstruction

Mechanism

A packet capture records observations at one network point, not an omniscient view of an application exchange. Missing packets, retransmissions, segmentation, offloading, and encrypted payloads complicate reconstruction. Separate transport-level reassembly from application parsing and keep the capture location and timestamp precision in mind.

Practical method

Inventory endpoints and protocols, then isolate the relevant conversation. Follow the reassembled stream and compare it with individual packets. Export objects only after confirming the protocol and completeness. Correlate request and response timestamps with a stated timezone and preserve the original frame numbers.

Wireshark display filters:
tcp.stream == 3
dns
http.request

Interpreting evidence

A reconstructed object should match its advertised length or checksum where available. An absent response can indicate capture loss or asymmetric routing rather than application failure.

Pitfalls and limits

Capture filters and display filters use different grammars. TLS hides application bytes unless suitable secrets are available. TCP sequence gaps should be documented before claiming a file is complete.