This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Can't find Socket ID. How can I know that all packets are in the same socket.

asked 19 Apr '16, 00:49

AMitiev's gravatar image

AMitiev
6224
accept rate: 0%


A socket is the combination of the IP address and the port. So if you're looking for sockets, combine source IP and source port, as well as destination IP and destination port.

permanent link

answered 19 Apr '16, 03:49

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

I wondered if the OP was asking about an actual socket instance for the client\server application.

If so, for TCP, each new socket will have to undertake the 3-way handshake, but in UDP for example, there's no clue in a capture file.

(19 Apr '16, 04:37) grahamb ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×6

question asked: 19 Apr '16, 00:49

question was seen: 2,092 times

last updated: 19 Apr '16, 04:37

p​o​w​e​r​e​d by O​S​Q​A