edit pass: analyze-a-packet-capture

Author: ShawnJackson

articles/network-watcher/network-watcher-alert-triggered-packet-capture.md

@@ -165,7 +165,7 @@ Get the tenant ID by running the following PowerShell cmdlet:
 
 #### AzureCredPassword
 
-The value of the `AzureCredPassword` environment variable is the value that you get from running the following PowerShell sample. This sample is the same one that the preceding [Authentication](#authentication) section showed. The value that you need is the output of the `$Encryptedpassword` variable. This output is the service principal password that you encrypted by using the PowerShell script.
+The value of the `AzureCredPassword` environment variable is the value that you get from running the following PowerShell sample. This sample is the same one that the preceding [Configure authentication](#configure-authentication) section showed. The value that you need is the output of the `$Encryptedpassword` variable. This output is the service principal password that you encrypted by using the PowerShell script.
 
 ```powershell
 #Variables

articles/network-watcher/network-watcher-using-open-source-tools.md

@@ -41,7 +41,7 @@ You can directly upload a packet capture from Network Watcher. Use the **Import
 
 When you're providing a link to CapAnalysis, be sure to append a shared access signature (SAS) token to the storage blob URL. Go to **Shared access signature** from the storage account, designate the allowed permissions, and select the **Generate SAS** button to create a token. You can then append the SAS token to the packet capture's storage blob URL.
 
-The resulting URL looks something like the following example: `http://storageaccount.blob.core.windows.net/container/location?addSASkeyhere`
+The resulting URL looks something like `http://storageaccount.blob.core.windows.net/container/location?addSASkeyhere`.
 
 ## Analyze packet captures
 
@@ -51,7 +51,7 @@ The following list describes a few of the CapAnalysis features:
 
 - Flow tables
 
-  The **Flow** tab lists flows in the packet data. For each flow, the tab shows information like the time stamp, source and destination IPs, and associated protocols.
+  The **Flows** tab lists flows in the packet data. For each flow, the tab shows information like the time stamp, source and destination IPs, and associated protocols.
 
   ![capanalysis flow page][5]
 
@@ -69,7 +69,7 @@ The following list describes a few of the CapAnalysis features:
 
 - Geographical map
 
-  The **GeoMAP** tab provides a map view of your network traffic. Colors scale to the volume of traffic from each country/region. You can select highlighted countries/regions to view additional flow statistics, such as the proportion of data sent and received from IPs in that country/region.
+  The **GeoMAP** tab provides a map view of your network traffic. Colors scale to the volume of traffic from each country/region. You can select highlighted countries/regions to view additional flow statistics, such as the proportion of data sent and received from IPs in a country/region.
 
   ![geomap][8]
 
@@ -83,7 +83,7 @@ To learn more about all the capabilities of CapAnalysis, go to the [tool's websi
 
 ## Conclusion
 
-You can use the Network Watcher packet capture feature to capture the necessary data to perform network forensics and better understand your network traffic. The scenario in this article showed you how you can integrate packet captures from Network Watcher by using open-source visualization tools. By using tools such as CapAnalysis to visualize packet captures, you can perform deep packet inspection and quickly identify trends in your network traffic.
+You can use the Network Watcher packet capture feature to capture the necessary data to perform network forensics and better understand your network traffic. The scenario in this article showed how you can integrate packet captures from Network Watcher by using open-source visualization tools. By using tools such as CapAnalysis to visualize packet captures, you can perform deep packet inspection and quickly identify trends in your network traffic.
 
 ## Next steps
 

articles/network-watcher/packet-capture-inspect.md

@@ -35,7 +35,7 @@ When a TCP connection is established, the first three packets sent in the connec
 
 1. Launch Wireshark.
 
-1. Load the **.cap** file from your packet capture session.
+1. Load the *.cap* file from your packet capture session.
 
 1. Select a [SYN] packet in your capture. This packet is the first packet that the client sends to initiate a TCP connection.
 
@@ -55,7 +55,7 @@ When a TCP connection is established, the first three packets sent in the connec
 
 1. Select the [SCK] packet.
 
-1. Expand the **SEQ/ACK analysis** section to show the initial RTT (iRTT) in seconds.
+1. Expand the **SEQ/ACK analysis** section to show the initial RTT in seconds.
 
     :::image type="content" source="./media/packet-capture-inspect/view-latency.png" alt-text="Screenshot that shows the latency represented as initial round-trip time in seconds in Wireshark." lightbox="./media/packet-capture-inspect/view-latency.png":::
 
@@ -67,7 +67,7 @@ In this example, you learn how to analyze a packet capture to find unwanted prot
 
 1. Open Wireshark.
 
-1. Load the **.cap** file from your packet capture session.
+1. Load the *.cap* file from your packet capture session.
 
 1. On the **Statistics** menu, select **Protocol Hierarchy**.
 
@@ -88,13 +88,13 @@ Understanding the types of traffic, the endpoints, and the ports for communicati
 
 1. Launch Wireshark.
 
-1. Load the **.cap** file from your packet capture session.
+1. Load the *.cap* file from your packet capture session.
 
 1. On the **Statistics** menu, select **IPv4 Statistics** and then select **Destinations and Ports**.
 
     :::image type="content" source="./media/packet-capture-inspect/destinations-ports.png" alt-text="Screenshot that shows how to get to the Destinations and Ports window in Wireshark." lightbox="./media/packet-capture-inspect/destinations-ports.png":::
 
-1. In the **Destinations and Ports** window, you can see the top destinations and ports that the VM communicated with during the capture session. You display only communication through a specific protocol by using a filter. For example, you can see if any communication used the Remote Desktop Protocol (RDP) protocol by entering **rdp** in the **Display filter** box.
+1. The **Destinations and Ports** window lists the top destinations and ports that the VM communicated with during the capture session. You display only communication through a specific protocol by using a filter. For example, you can see if any communication used Remote Desktop Protocol (RDP) by entering **rdp** in the **Display filter** box.
 
     :::image type="content" source="./media/packet-capture-inspect/rdp-filter.png" alt-text="Screenshot that shows the RDP destinations and the ports that were used in Wireshark." lightbox="./media/packet-capture-inspect/rdp-filter.png":::