Look at 3 way handshake (SYN, SYN/ACK, ACK.)
- Client side trace will have delay between SYN & SYN/ACK
- Server side trace will have delay between SYN/ACK & ACK.
Duh, this is obvious! Some might say. But I find it insightful as TCP analysis is just a "hobby" -- I do it so rarely in my work that I learn and re-learn each time I need to slog through a trace file.