Why I Started Saving Packet Captures with the Incident Notes
A short pcap plus context is often more useful six months later than a page of remembered conclusions.
Wireshark
My First Useful Wireshark Capture: ARP Before ICMP
Capturing a simple ping showed that the interesting packet often arrives before ICMP: ARP has to resolve the Layer 2 destination first.
Reading My First SIP REGISTER and INVITE in Wireshark
SIP became much less mysterious once I stopped reading it as 'phone system traffic' and followed it as a text-based request and response protocol with explicit state transitions.