This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Stream index calculation

0

I have a question about Stream index... it is calculated by some mathematical formula or some other ways? or its related to source port and destination port?

asked 31 Mar '14, 02:20

Petrusca%20Victor's gravatar image

Petrusca Victor
1●1●1●1
accept rate: 0%

One Answer:

0

It is counted by conversation, which is based on TCP and UDP socket pairs. So each socket pair (consisting of IP_1:Port_1 - IP_2:Port_2) is a conversation, with TCP and UDP being calculated separately.

The first conversation has stream index 0, the second has stream index 1, and so on.

answered 31 Mar '14, 03:41

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

thanx for answer Jasper

(31 Mar '14, 06:51) Petrusca Victor

Hi Jasper, is there a way to get the stream index number if we provide packet number to tshark?

(25 Apr '16, 12:36) WSharkUser

yes, like this, e.g. for file "test.pcapng" and frame number 100:

tshark -r "test.pcapng" -Y "frame.number==100" -Tfields -e tcp.stream

(25 Apr '16, 12:45) Jasper ♦♦