Guides
What the report says, explained — and how to take a capture worth reading.
What a capture is telling you
Connection refused
A reset came back instead of a SYN-ACK. The host is up and reachable; nothing is
listening on that port, or a policy refused it. This is the one failure that proves the far end received your
packet.Read the guide →
No SYN-ACK at all
The SYN left and nothing came back. A drop in the path, no route, or a host that is down
— and in a one-sided capture, possibly a reply your filter excluded.Read the guide →
Reset after data flowed
The connection worked, then one side cut it. Which side sent the reset is usually the
whole answer, and the report says which.Read the guide →
Zero window
The receiver advertised no buffer space: its application stopped reading. The network is
fine. This is the finding that most often redirects a ticket away from the network team.Read the guide →
Retransmissions
Segments went unacknowledged and were sent again, which means loss somewhere on the path.
A few are normal; a lot are not.Read the guide →
TLS handshake failure
The ClientHello went out and no ServerHello came back, or an alert ended it. The alert
names the reason — an untrusted issuer, an expired certificate, no version in common.Read the guide →
NXDOMAIN
The name does not exist. Nothing after that can work, and it is frequently mistaken for a
network fault because the symptom is identical.Read the guide →
Unanswered ARP
Nothing claimed the address on this segment. From the sender’s point of view this is
indistinguishable from a firewall drop, which is why it is worth ruling out first.Read the guide →
Taking the capture
Two rules carry everything: capture whole packets with -s 0, and capture both directions with host X rather than src host X.
The exact command for tcpdump, Wireshark, SPAN, Palo Alto, FortiGate, Check Point, Cisco ASA, F5, AWS, Azure, Kubernetes, MikroTik, Juniper and Windows is on the features page.
Check something else next
The other modules look at the same target from a different angle.