This file can be found in the blob it was saved in our locally on the virtual machine, depending on how you configured it. For more information on the TCP protocol and the three-way handshake, refer to the following resource. This latency is referred to as the Round Trip Time (RTT). By examining the first two packets sent in this handshake, an initial request from the client and a response from the server, we can calculate the latency when this connection was established. When a TCP connection is established, the first three packets sent in the connection follow a pattern commonly referred to as the three-way handshake. In this scenario, we show how to view the initial Round Trip Time (RTT) of a Transmission Control Protocol (TCP) conversation occurring between two endpoints. To learn how to create a packet capture visit Manage packet captures with the portal or with REST by visiting Managing Packet Captures with REST API. This scenario assumes you already ran a packet capture on a virtual machine.

This scenario uses WireShark to inspect the packet capture. These scenarios illustrate capabilities that can be accessed by reviewing a packet capture.

This article goes through some pre-configured scenarios on a packet capture that was run previously. We'll also provide examples showing how to calculate a connection latency, identify abnormal traffic, and examine networking statistics. In this article, we show how to open a packet capture file provided by Network Watcher using a popular open source tool. Some example uses of packet capture data include: investigating network or application issues, detecting network misuse and intrusion attempts, or maintaining regulatory compliance. Leveraging freely available tools to inspect the data, you can examine communications sent to and from your VMs and gain insights into your network traffic. Packet capture allows you to address scenarios that require packet level data by providing the information in a readily usable format.

Using the packet capture feature of Network Watcher, you can initiate and manage captures sessions on your Azure VMs from the portal, PowerShell, CLI, and programmatically through the SDK and REST API.

Wireshark packet