Question 1

How do you troubleshoot TCP retransmissions and packet drops in Wireshark?

Accepted Answer

TCP retransmissions occur when an ACK is not received before the Retransmission Timeout (RTO) expires. In Wireshark, use display filter 'tcp.analysis.retransmission' or 'tcp.analysis.fast_retransmission' to identify dropped packets. Inspect delta times and check if retransmissions correlate with specific network hops, duplex mismatches, firewall queue drops, or MTU black holes.

Question 2

What causes TCP Zero Window errors in packet captures?

Accepted Answer

A TCP Zero Window ('tcp.analysis.zero_window') is signaled by the receiver when its socket buffer (TCP receive window) is completely full, meaning the application layer is failing to drain data from the buffer fast enough (e.g. CPU starvation, database locking, or slow disk I/O). The sender must pause transmission and send Zero-Window Probes until a Window Update is issued.

Question 3

How does a Next-Gen Firewall process packets through its pipeline?

Accepted Answer

A Next-Gen Firewall processes ingress packets through 9 systematic stages: (1) Ingress Interface & Zone Binding, (2) Anti-Spoofing & DoS Rate Limiting, (3) Destination NAT / Virtual IP lookup, (4) FIB Routing lookup, (5) 5-Tuple Stateful Session matching, (6) Security Policy ACL evaluation, (7) Layer 7 App-ID, IPS & SSL Forward Proxy Decryption, (8) Source NAT / PAT translation, and (9) Egress serialization with TCP MSS clamping.

Question 4

What is SSL Forward Proxy decryption and how is it analyzed in Wireshark?

Accepted Answer

SSL Forward Proxy (Inbound/Outbound SSL Inspection) acts as an enterprise Man-in-the-Middle (MITM) proxy. The firewall terminates the client's TLS session using a trusted enterprise Sub-CA root certificate, inspects the cleartext L7 stream for malware/data loss, and initiates a separate TLS session to the upstream destination server. In Wireshark, RSA/TLS pre-master secret key logs (SSLKEYLOGFILE) can be imported to decrypt the TLS stream.

Question 5

Where can I practice enterprise vendor PCAPs for Cisco, Palo Alto, and F5 BIG-IP?

Accepted Answer

You can access enterprise multi-vendor PCAP lab walkthroughs at the official portal https://wireshark.cyberbruharmy.in/ and enroll in the full video training course on Udemy (Referral Code: FE112B7F1FC8DCD88DD3).