Gary VirkIT support / infrastructure
← All work

05 Networking · TShark · Troubleshooting

Packet triage evidence library

Five small packet cases that connect a user-visible symptom to a decisive filter, bounded change, and different post-change capture.

Validated result

DNS, TCP, ARP, path-MTU, and DHCP failures were reproduced and each post-change check passed.
  • TShark
  • Capinfos
  • tcpdump
  • Python
05Packet cases
05Post-change checks
02Captures per case

01 · The support question

What needed to be known?

A packet capture is only useful when the analyst can state where it was taken, which frames matter, what changed, and what a separate validation capture proves.

02 · The build

A controlled path from fault to retest.

  1. 01

    Created controlled DNS, TCP reset, duplicate-IP ARP, path-MTU, and DHCP-option failures.

  2. 02

    Replayed each capture through fixed TShark field selections instead of trusting authored outcome text.

  3. 03

    Derived decisive frames and findings from the supplied protocol fields.

  4. 04

    Bound every failure and post-change capture by SHA-256 and carried the lab limitations into each report.

CheckFailure evidencePost-change
DNSNXDOMAINA record returned
TCPRSTHandshake + echo
ARPTwo ownersOne owner
Path MTUICMP 3 / 4Payload delivered
DHCPWrong routerReviewed router
Selected evidence summary · full claims remain bounded below

03 · What proves it

Evidence tied to the claim.

01

DNS / TCP

NXDOMAIN became a valid A answer; a reset to a closed port became a completed handshake and echoed payload.

02

ARP / path MTU

Two MAC owners became one; ICMP type 3/code 4 with MTU 1200 disappeared after the path was restored.

03

DHCP

The incorrect router option is imported from the separately validated DHCP project and checked against the same captured transaction.