An expert system that provides an analysis of protocol exchanges and protocol relationships across multiple data units, such as packets, of a network and within data units themselves is described. The system collects a number of facts and based on rules governing the data units, new rules and facts are gained from the analysis. The invention is extensible for additional protocols and diagnostics by updating a knowledge database with dynamic rules for any application or protocol desired.