Computer A connects to zttechacademy.com on port 443. Follow each segment and see its real bytes.
TCP is the protocol that gives applications a reliable connection. Before any data is sent, the two computers agree on starting sequence numbers with a three-way handshake: SYN, SYN-ACK, ACK. Web browsing, SSH, email and most other applications start this way.
Why it matters. Handshake failures are some of the most useful troubleshooting clues. A refused connection and a timeout mean very different things, and the Break it scenarios show both.
How to use this lab. Use Next and Back to move through the steps. Switch between relative and raw sequence numbers, and between the TCP header and the whole frame.
Where it fits. It pairs with the Frame Inspector, which shows the same frames as part of a full conversation.
Every segment is shown as captured at Computer A’s network card, so frames from the server arrive with the gateway’s MAC address and a lower TTL. Addresses are examples (203.0.113.5 is reserved for documentation). Retransmit timings are Linux defaults; other operating systems differ. Relative numbers are what Wireshark shows by default; the bytes on the wire always hold the raw values.