CapurisDocs
Browse documentation
DocsReference

Use cases

Use packet evidence to answer common security, performance, reliability, and change questions.

Packet data is most valuable when an investigation begins with one answerable question. The patterns below show how to turn a symptom into a small evidence set and an operational decision.

A repeatable method

  1. Write down the question, affected endpoints, observation point, and shortest useful time window.
  2. Protect the source capture before filtering or exporting it.
  3. Search by known facts first: time, address, port, protocol, VLAN, or flow.
  4. Compare the event with a healthy period or a second capture location.
  5. Confirm graph and report findings in the underlying packets.
  6. Export a focused PCAP with the filters, time zone, and conclusion.

Verify a firewall change

Question: Did the new policy preserve every required application flow and its return path?

Capture on both sides of the firewall before and after the maintenance window. Search for the application endpoints and service ports, then compare handshakes, resets, retransmissions, and response timing. A request that appears on one side but not the other identifies a forwarding or policy boundary. A complete handshake followed by delayed application data points beyond simple reachability.

Deliver a service-by-service pass or fail table plus a compact PCAP for every changed flow.

Find the source of branch-office SaaS delay

Question: Does delay begin on the branch, across the WAN, or at the service?

Start with an affected user, branch egress address, application hostname, and incident time. Compare the relevant TCP flows with a healthy interval. Review connection setup, retransmissions, round-trip time, and request-to-response gaps. If two observation points are available, align the same packets and find where delay first grows.

The result should direct ownership to the local access path, carrier, enterprise network, or application team.

Identify the first service in a retry storm

Question: Which dependency failed before the visible wave of retries?

Search from the front-end virtual IP, ingress, or service port. Use relationship analysis to list downstream peers, then compare normal and degraded windows. Repeated connection attempts, resets, short sessions, or long response gaps can reveal the first unhealthy dependency. When HTTP is visible, correlate status patterns with the packet timing.

Export the earliest failing exchange, not only the later high-volume retry traffic.

Bound ransomware lateral movement

Question: Which systems established meaningful communication with the affected host before containment?

Search around the first endpoint alert using the host address and VLAN. List internal peers and order them by first and last contact. Narrow the result to administrative and file-sharing protocols used in the environment, then distinguish scanning and failed attempts from established sessions.

Provide responders with a peer list and separate PCAPs for confirmed connections. Packet evidence should complement, not replace, endpoint and identity telemetry.

Separate database delay from network delay

Question: Did the transaction wait in the network or at the database tier?

Compare a stalled transaction with a healthy transaction between the same application and listener. Inspect round-trip time, retransmissions, resets, receive-window behavior, and idle gaps between requests and replies. Two synchronized capture points can show whether the delay exists before or after the database-side path.

Stable transport timing followed by a long server response gap supports application or database ownership. Rising delay, loss, or window pressure gives the network team a precise flow and interval.

Explain an increase in cloud egress

Question: Which workload sent data, where did it go, and when did the change begin?

Search the cloud interconnect or internet edge for the billing window. Group bytes by workload address, destination, protocol, and time, then compare with the prior day or week. Validate the largest new relationship in the underlying packets.

The evidence should identify a specific transfer pattern—such as backup, replication, export, or routing change—rather than merely restating the billing total.

Diagnose voice degradation

Question: Where did signaling or media behavior first diverge from a healthy call?

Use the affected call time and endpoints to separate call-control traffic from media streams. Compare both media directions for packet spacing, loss, sequence continuity, and path. When possible, align captures at the session border controller and WAN edge.

Package the signaling, media packets, and a short timeline of the first anomaly for the voice, carrier, or platform owner.

Resolve a multi-vendor incident

Question: At which component or hop does the shared packet timeline first change?

Record the same flow at two or more synchronized points. Apply equivalent filters and compare decisive packets by timestamp, presence, and content. Include observation location, expected behavior, actual behavior, and one focused PCAP from each point.

This replaces competing dashboard summaries with evidence each vendor can reproduce.

Useful companions