This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

By default, Wireshark shows the entire packet breakdown in the order that it captured the packets split across three frames. Pretty much the only thing I ever do with Wireshark is reverse engineer captured HTTP requests. This basically amounts to Wireshark's default UI getting in the way of seeing the request and response - all three frames of the main UI are nearly useless to me.

Whenever I use Wireshark, I find myself constantly right-clicking on a TCP stream, selecting "Follow TCP Stream", closing the dialog box, clicking "Clear" on the filter, and repeating that process quite a few times. I would much prefer a view of all available streams and be able to single or double-click them to view the raw data. Is there such a view available?

asked 31 May '13, 08:14

gina_miller's gravatar image

gina_miller
16114
accept rate: 0%


Something 'similar' would be

Statistics -> Conversations -> TCP

Then select one conversation and click on Follow Stream. Check the data. Then go back to the conversations window and repeat that step. It's not exactly what you want (not possible with the current Wireshark GUI), but it may help to speed up your work a bit.

Regards
Kurt

permanent link

answered 31 May '13, 08:19

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

That is better than what I was doing. Since it is the only solution, I'll accept this as the answer. Thanks!

(31 May '13, 09:06) gina_miller
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×29

question asked: 31 May '13, 08:14

question was seen: 1,207 times

last updated: 31 May '13, 09:06

p​o​w​e​r​e​d by O​S​Q​A