How can I view stream lists

Question

I like to see the list of TCP streams from my packet capture. Something like this:

Source     Dest    Prot Port Start        End
1.1.1.1 -> 2.2.2.2 TCP   445 12:00:00.000 12:00:03.000
1.1.1.1 -> 3.3.3.3 TCP    80 12:00:04.000 12:00:05.000
1.1.1.1 -> 2.2.2.2 TCP   445 12:00:07.000 12:00:09.000 (a different stream than the first)

I looked at Statistics/FlowGraphs, but that seems to show all the SYN/ACK details in each stream (too much information to go though). I looked at Statistics/ConversationList, but that appears to combine the first and the third in the example above (not enough information).

This would be so I can document the traffic going between my application servers. For instance: workstation A talks to server B, which starts server B talking to server C, etc. Is there a way to do this in Wireshare, or am I incorrect in my assumptions? Thanks!

Answer 1

The functionality that matches your request the most is "Statistics -> Conversations" and then the TCP tab, it will show you the details of every single TCP session in the tracefile.

If you need the output to be exactly like the table you included in your question, then you would need to do some scripting or programming yourself. You can either use LUA within Wireshark or use tshark with some shell scripting (or perl or ...).