My First Useful Wireshark Capture: ARP Before ICMP
Capturing a simple ping showed that the interesting packet often arrives before ICMP: ARP has to resolve the Layer 2 destination first.
packet capture
tcpdump Became My First Tool Before Wireshark
On a headless Linux box, tcpdump was faster than moving captures around blindly. A narrow capture at the right interface often answered the question immediately.