By default, Wireshark shows the entire packet breakdown in the order that it captured the packets split across three frames. Pretty much the only thing I ever do with Wireshark is reverse engineer captured HTTP requests. This basically amounts to Wireshark's default UI getting in the way of seeing the request and response - all three frames of the main UI are nearly useless to me. Whenever I use Wireshark, I find myself constantly right-clicking on a TCP stream, selecting "Follow TCP Stream", closing the dialog box, clicking "Clear" on the filter, and repeating that process quite a few times. I would much prefer a view of all available streams and be able to single or double-click them to view the raw data. Is there such a view available? asked 31 May '13, 08:14  gina_miller |
One Answer:
Something 'similar' would be
Then select one conversation and click on Follow Stream. Check the data. Then go back to the conversations window and repeat that step. It's not exactly what you want (not possible with the current Wireshark GUI), but it may help to speed up your work a bit. Regards answered 31 May '13, 08:19  Kurt Knochner ♦ |
That is better than what I was doing. Since it is the only solution, I'll accept this as the answer. Thanks!