Every packet.
Explained.

What comes back

• Every conversation — source and destination IP, ports, protocol, the service on the wire (identified from the bytes, not just the port number), byte counts, duration.
• The handshake, drawn — SYN, SYN-ACK, ACK with the real timings, MSS, window scaling, and the measured RTT.
• Certificate negotiation — SNI, offered and chosen TLS version, cipher, ALPN, the full certificate chain with subject, issuer, validity, key size, and whether the name actually matches what the client asked for.
• Sequence analysis — retransmissions, duplicate ACKs, out-of-order segments, gaps, zero windows, keep-alives, who reset the connection and when.
• A verdict per stream — healthy, degraded, or failed, with the likely cause written out.