The problem
Symptoms such as a slow application or an unreachable service can originate at different layers. Looking at packet counts alone is not enough to distinguish name resolution, connection establishment, retransmissions, or an application response.
The approach
Define the symptom, identify the endpoints and capture location, then follow the relevant exchange in order. For a name-resolution investigation, examine the query and response before tracing the connection to the returned address.
Useful evidence
The fieldbook organizes observations around timestamps, source and destination addresses, protocol exchanges, and a small number of focused filters. Missing traffic is treated as a clue to investigate, with capture scope, caching, and alternate protocol paths considered before drawing a conclusion.
Current scope and next steps
This is a learning and documentation workflow, not a claim of a completed client engagement. The goal is to build repeatable lab examples and sanitized notes that explain the reasoning without exposing production captures or customer data.