Sample Agent report: slow SaaS sign-in
Representative Agent Pro output for TLS and TCP latency triage across a SaaS login path.
Reproducible packet references
74-82
Delayed ServerHello
ClientHello is followed by a delayed ServerHello on affected login attempts.
tls.handshake.type in {1 2}91-119
WAN retransmission burst
Retransmissions align with the handshake delay window.
tcp.analysis.retransmission || tcp.analysis.fast_retransmission142-166
Normal application response after handshake
Once TLS completes, application response timing is within the expected range.
http.response.code == 200 || http2Executive Summary
This sample Agent report separates network-path delay from application delay. The evidence points to packet loss during TLS setup, followed by normal behavior after the session is established.
Findings
- DNS and TCP connection setup complete before the user-visible stall.
- TLS ServerHello is delayed on affected attempts and overlaps with retransmission markers.
- HTTP response timing after handshake does not support a server-side think-time root cause.
Recommended Actions
Run paired client and edge captures during the same sign-in window. Compare TCP loss, RTT, and TLS handshake timing by capture point. Escalate to the WAN/provider path if the edge capture stays clean while client-side retransmissions persist.
Evidence Anchors
| Anchor | Packet evidence | Reproduce |
|---|---|---|
| TLS-1 | Frames 74-82 show ClientHello to ServerHello delay. | tls.handshake.type in {1 2} |
| TCP-1 | Frames 91-119 contain retransmission markers during the stall. | `tcp.analysis.retransmission |
| HTTP-1 | Frames 142-166 show normal response once TLS is complete. | `http.response.code == 200 |
Buyer Note
This sample demonstrates why Agent Pro should not stop at a generic "SaaS is slow" answer. The report separates network delay from application behavior and gives a reproducible packet path.