This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a very big TCP dump between two servers. There are only two IP addresses so each conversation is defined by the TCP ports used. My question is how do I group the the data by conversations such that all the output is still there just grouped by unique conversation

asked 08 Nov '13, 13:29

mrw_1955's gravatar image

mrw_1955
11112
accept rate: 0%


There is no such grouping feature in Wireshark, at least not in the 'main' GUI.

What you can do:

  • View Conversations: Statistics -> Conversations -> TCP (tab). Then select one conversation and click on 'Follow Stream'. That will create a display filter to show only that single conversation
  • Set a display filter manually: tcp.stream eq 0 or tcp.stream eq 1 etc.

Regards
Kurt

permanent link

answered 08 Nov '13, 15:36

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

try using Splitcap tool, its excellent, works very fast and has various options to manipulate the capture file

permanent link

answered 10 Nov '13, 22:52

deepacket's gravatar image

deepacket
31224
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×34

question asked: 08 Nov '13, 13:29

question was seen: 6,763 times

last updated: 10 Nov '13, 22:52

p​o​w​e​r​e​d by O​S​Q​A