The protagonist sits at his desk again, sunglasses back on with a determined "let's prove it" grin, while his second monitor shows two domain-controller tower icons labeled DC1 and DC2 connected by a dotted line, set up to reboot one and capture the trace on the other.
A raw NetMon capture fills most of the panel as a dense wall of unfiltered rows, with the protagonist small in the corner squinting hard and pushing his sunglasses up, tiny Greek letters floating off the screen toward his face. A caption reads: "When you first examine AD replication traffic in NetMon... it looks like Greek. What the heck is a stub parser? DRSR?"
His cursor clicks "Windows" in a Parser Profiles list, a blue arrow pointing at the selection, as the capture switches from the default parser to one that renders it in plain English.
He adds color-coded highlighter tabs to four sticky notes on his monitor bezel, each labeled DRSR, EPM, MSRPC, and DNS in a matching color, then filters the capture down to just the msrpc traffic.