This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm aware of the Wireshark feature which allows us to view a single stream that a particular packet is associated with. However, I would like to view multiple streams in the order that they were captured.

Is this possible? If so, how?

Edit for clarity

I'm looking for a way to view multiple streams in a single "Follow TCP Stream" window. You know how you can right-click on a packet and select "Follow TCP Stream" and new window pops-up showing you the entire stream? - Well, I would like to be able to have multiple streams in that same window.

My goal is have an easy way of viewing all streams that occurred during a web browser session. So, right now, what I'm doing is doing the following steps:

  1. Filter: "tcp.stream == 0"
  2. Right-click, select "Follow TCP Stream"
  3. Save the stream to disk (by clicking "Save As")
  4. Filter: "tcp.stream == 1", then repeat steps 2 and 3
  5. Filter: "tcp.stream == 2", then repeat steps 2 and 3
  6. Filter: "tcp.stream == [n]", then repeat steps 2 and 3
  7. Using Notepad, combine all the saved streams in sequential order.

The result of the procedure above will be useful to me, but creating it is a bit cumbersome.

asked 18 Jan '13, 09:29

KTM's gravatar image

KTM
7691314
accept rate: 100%

edited 18 Jan '13, 11:04


You can see multiple streams by filtering on the TCP stream index number of the streams you want to see: "tcp.stream==1 || tcp.stream==4 || tcp.stream==5"

You can see all TCP streams with "tcp".

However, the packets will be shown in the order they were captured, so packets from different streams will be intermingled in the display if the streams were running simultaneously. To make it clear which packets belong to which stream, you can right-click on a packet in the Packet List and select Colorize Conversation > TCP > [Color 1, Color 2, etc.]. You can colorize up to 10 different conversations. Be careful which colors you pick; some of them are very similar and are difficult to distinguish on the screen.

permanent link

answered 18 Jan '13, 10:43

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%

Thanks for the colorize tip. I'll definitely use that. However, my goal is to be able to view multiple streams in a single "Follow TCP Stream" window (or something like that).

I've edited my OP to clarify the intent of my question.

(18 Jan '13, 11:07) KTM
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×61
×12

question asked: 18 Jan '13, 09:29

question was seen: 10,236 times

last updated: 18 Jan '13, 11:07

p​o​w​e​r​e​d by O​S​Q​A