Decoding the packet flow
A packet capture shows every packet that crosses the network interface, with timestamps and decoded content. A simple HTTP fetch starts with a TCP handshake: client sends SYN (sync) to the server. Server responds with SYN/ACK. Client sends ACK back. All three messages are visible in the trace. Then the client sends the HTTP GET request (headers, query string, body) in one or more packets. Server responds with HTTP 200, the response headers, and the body in chunks.
Performance analysis through packet timing
Wireshark annotates each packet with its absolute timestamp and the delta (time since the previous packet on that stream). A SYN arriving at 100.000ms, SYN/ACK at 100.050ms, GET at 100.051ms, and response at 100.150ms tells you the server took 99ms to generate the response. Retransmissions appear as duplicate packets. Packet sizes reveal inefficient chunking (tiny packets waste header overhead). Out-of-order delivery (sequence numbers ascending non-monotonically) signals congestion or dropped packets.
Debugging network issues
Captures reveal problems invisible to application logs: FIN packets show unexpected connection closes, RST packets indicate protocol violations or timeouts, ICMP messages report routing failures. Filtering traces (e.g., tcp.port == 443) isolates relevant packets. Comparing captures from the client and server sides pinpoints asymmetric routing or firewall issues. A packet lost on one hop appears in the client's trace but not the server's, immediately localizing the problem.