Terms for the technical inventory below
Snap length: maximum bytes stored from each packet.
ISN: initial sequence number, where one side starts its TCP numbering.
DF: the IPv4 Do Not Fragment bit, a request not to split that packet
into fragments for forwarding.
TTL: Time to Live, used as a hop budget; a router reduces it when
forwarding so a packet cannot circulate indefinitely.
Frame check sequence (FCS): an error-detection value for a link frame.
Checksum: a calculated error-detection value checked against received
bytes. These checks can detect corruption; they do not authenticate
the sender or encrypt the content.
if_tsresol: the pcapng interface option describing timestamp resolution,
which tells how much time one timestamp unit represents.

How to interpret these supplied files

Synthetic means constructed teaching data, not a live-network recording.
The model tables, stored frames and historical file reads are distinct:
W1 is paper only; intro-demo contains only its three stated TCP frames.
No described listener or echo card is silently added to a stream file.

Historical file-read record, 2026-10-12:
TShark 4.2.2 read the four supplied files. The earlier record reports
three zero-payload setup frames in intro-demo, list/listed in the worked
stream, ask/noted in the activity stream, and keep/kept in the stage
stream. Each application word has one trailing newline. That operation
read constructed bytes; it did not record a network or use the Wireshark
graphical interface. This note does not claim a new file read.

Provenance for the Stage 05 pcapng files. Synthetic bytes. Not a capture.

These files are pcapng blocks built in memory. They do not open a socket, select an interface, or run Wireshark, tcpdump, or tshark.
No if_name option is written. The name lab0 exists only in the lesson text. The file's interface id is 0.
Link type is 1, Ethernet. Snap length is 65535.
There is no if_tsresol option, so the timestamp unit is the specification default of microseconds.
Clock base is 1767225600 seconds, labeled 2026-01-01 00:00:00 UTC. Frame i is base plus i microseconds.
Frames are not padded to 64 bytes and include no frame check sequence.
IPv4 headers have no options, DF is set, and TTL is 64. TCP headers have no options and the window field is 65535.
Header checksums are part of the file as written. The stream payloads were list, listed, ask, noted, keep, and kept, each followed by one newline.

intro-demo.pcapng
Three TCP frames, client ISN 1000, server ISN 5000.
desk 192.168.50.10:49152 and shelf 192.168.50.23:9090.
SYN, SYN-ACK, ACK. No payload. The paper frame W1 is not in this file.

streams-demo.pcapng
Same peers and ports, same initial sequence numbers, then payloads.
desk sends list and a newline. shelf sends listed and a newline.

streams-field.pcapng
desk 192.168.50.10:49160 and shelf 192.168.50.23:9092.
Client ISN 2000, server ISN 8000.
desk sends ask and a newline. shelf sends noted and a newline.

network-observation.pcapng
desk 192.168.50.10:49170 and shelf 192.168.50.23:9090.
Client ISN 3000, server ISN 9000.
desk sends keep and a newline. shelf sends kept and a newline.
The echo card and the listener card are not packets in this file.

MAC values are documentation EUI-48 values: desk 00-00-5E-00-53-10, shelf 00-00-5E-00-53-23.