Make a capture on shadow0 (or elsewhere) of some TCP traffic (using HTTP or SSH or whatever you wish).
Analyze that traffic using stak. Note major events such as the 3-way handshake for open, and the 4-way handshake for close (if it occurs), also major events during traffic. YOU figure out what major events might be!
Make a capture on shadow0 (or elsewhere) of some UDP traffic (using DNS or any other UDP-based protocol.
Make a stak analysis of the capture. Note specifically that there is no such thing as a connection in any formal sense.