Executive Summary
This sample Agent report attributes the slow HTTP download to TCP loss and recovery behavior. The strongest evidence is the timing of retransmissions and duplicate ACKs around the affected transfer window.
Findings
- Retransmissions appear during the period where the transfer slows down.
- Duplicate ACK behavior points to transport recovery rather than a clean server-side stall.
- The HTTP exchange remains active, so the next operator action should focus on the network path and affected endpoints.
Recommended Actions
Inspect the listed frame range, compare client and server retransmission markers, and repeat a short capture from the opposite side of the path if the first capture point cannot distinguish local loss from upstream loss.
Evidence Anchors
| Anchor | Packet evidence | Reproduce |
|---|---|---|
| TCP-1 | Frames 120-180 contain retransmission markers. | `tcp.analysis.retransmission |
| TCP-2 | Frames 150-210 show duplicate ACK or lost-segment behavior. | `tcp.analysis.duplicate_ack |
| HTTP-1 | Frames 80-240 keep the HTTP transfer in scope while TCP recovery occurs. | `http |
Buyer Note
This sample demonstrates the value of keeping PacketSafari answers anchored in transport evidence instead of stopping at a vague "download is slow" summary.