Read the control on the wire

Before you start

You are handed real captured network traffic and asked to read three control claims directly off the bytes — "only 443 is exposed," "encrypted in transit," "the L2 trust assumption holds" — then diagnose the single byte where a real broken capture contradicts its claim. This surface is the packet itself, rendered as nested byte-range regions. A layer stays closed until you read the selector byte that justifies opening the next one. Every value you reveal is the dissector's real decode of the real bytes — the same value tshark produces. Nothing is invented; the packet is the answer key. Start on the clean capture (Pair A · clean).