What a capture proves
Separate routing, response delivery, and what appeared on screen.
Follow a request through the proxyDistinguish a tunnel, a response served locally, and a response forwarded from the origin.Trust & authoritySeparate permission to route traffic from permission to inspect or change it.Inside the Mac workbenchThe networking engine and the desktop interface have different jobs.
Read the evidence in order
A matching request proves traffic reached the listener. A tunnel does not show the decrypted response. A completed segment transfer does not prove a player decoded it. Record what you observed on the device alongside the network trace.