Investigation strategy

Figure  illustrates the basic steps to follow for resolving a typical support complaint. We start by defining the filter for a flow, specifying one or more fields associated with the flow, and then go on to aggregating the results based on the xid. If more than one slice appears in the traffic, then we specify additional filtering criteria based on the report, or based on our perusal of the returned results.

Figure: Typical investigation of a support complaint