At a small branch, a nightly job on host 10.4.2.11 sends files to 10.4.9.20 on TCP 445 through the Threat Defense inside interface, and lately the transfer stalls with zero bytes sent. A job timeout is your only clue, so you need frame-level proof of arrival plus the exact point where processing ends. Which two troubleshooting checks confirm arrival on the wire and locate that stopping point?
Select an answer to reveal the explanation.
Short Explanation
You need two views: the wire and the processing path. The packet capture proves the frames really arrive on the inside interface, while packet-tracer simulates the same flow through the policy pipeline and names the point where it stops. It's the loading-dock camera plus the assembly-line timeline, and you need both halves.
Full Explanation
The required checks answer two different questions: whether packets from the branch host actually reach the Threat Defense inside interface, and where the device stops processing that flow. The filtered inside-interface capture provides frame-level evidence of arrival for the specified host and TCP port; packet-tracer then walks the flow through policy and processing checks and identifies the phase at which it is dropped or otherwise stopped. Packet-tracer is a simulation, so pairing it with a capture avoids treating a predicted path as proof that the nightly traffic arrived. A packet-tracer result correlated with access-control rule order and hit counts can help interpret policy behavior, but it still does not establish that frames for this particular attempt reached the interface. A capture paired with FMC connection events proves arrival and may show the rule or action associated with a connection, but that event information does not necessarily pinpoint the exact processing phase where handling ended. A capture correlated with ASP drop counters also proves arrival and can suggest a drop reason, but counters are generally aggregated and do not locate the precise stopping phase for this flow. Exam caveat: packet-tracer models a test flow and may not reproduce every runtime condition, such as an existing connection or dynamic state. Practical check: capture during the job window with a narrow host-and-port filter, then compare the observed packet details with the packet-tracer inputs and result.