This is our old Q&A Site. Please post any new questions and answers at

Hi I'm trying to find a performance issue with wireshark

I have a capture where the start request (a HTTP POST request) is the packet n° 14481 This request is acked in the packet 423239 66.05 seconds later These start and ack packets have the TCP Stream n° : 106

Between i have thousan of mysql requests but in the TCP Stream n° : 2

My question is :

As the TCP Stream of the mysql request (2) is less than the TCP Stream of the HTTP requests (106), can i suppose that they are not part of my HTTP request ?

And if yes how can i filter in order or only have the ones that where executed between my HTTP request ?


asked 28 Jan '16, 01:27

jojoRoro40's gravatar image

accept rate: 0%

I am not sure, if I understand your question correct. But maybe this two articles can help you a little bit:

(28 Jan '16, 03:16) Christian_R

  • If tcp is used to transport http, both the http request and the response to it always use exactly one tcp session. But the same tcp session may be used by several request/response pairs - more than that, it is almost always the case.

  • is not a field you could find in the packet contents. It is a "virtual" or "pseudo" field, i.e. an attribute of a frame which Wireshark generates, in order to make packet analysis easier, by aggregating several real packet fields together. It is the order number of the beginning of that particular tcp session in that particular capture; if you would modify a capture file by removing all packets matching display filter == N from it, stream N+1 from the original file would become stream N in the modified file.

To finish the answer, I need you to explain more precisely what you had in mind when writing

how can i filter in order or only have the ones that where executed between my HTTP request ?

If you had in mind "I want to see all packets, no matter to what tcp session they belong, which have been captured between the http request in tcp stream 106 and the response to it", then you can use a display filter frame.number >= N and frame.number <= M, where N would be the frame number (the leftmost column in default layout of the packet list pane) of the http request, and M would be the frame number of the response.

permanent link

answered 28 Jan '16, 02:58

sindy's gravatar image

accept rate: 24%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 28 Jan '16, 01:27

question was seen: 2,477 times

last updated: 28 Jan '16, 03:16

p​o​w​e​r​e​d by O​S​Q​A