Abstract: A method, system and computer program product for analyzing link failure in a network is described, wherein a protocol analyzer captures handshake protocol frames exchanged by two nodes attempting to establish a physical link. The captured handshake protocol frames ordered sets are displayed to the user in a merged, time-ordered list, and the information contained in the frames is decoded and displayed. If an attempt to establish a link fails, the symptoms of the failure and a possible diagnosis are identified and displayed. The user is thereby provided with a complete, understandable picture of the events leading up to the link failure, and with symptoms and possible cause of the link failure.