This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I just can't figure out what the 8 stands for in (tcp.stream eq 8)?

asked 26 Oct '11, 07:42

0xffff0's gravatar image

0xffff0
6113
accept rate: 0%


It indicates that this is the 8th TCP or UDP stream found in the trace.

Before we had stream numbers a filter to identify the stream would specify a pair of IP addresses and port numbers, resulting in much longer display filters.

permanent link

answered 26 Oct '11, 08:57

packethunter's gravatar image

packethunter
2.1k71548
accept rate: 8%

I.e., the 8 has no deep significance - it's just a number that Wireshark uses internally.

(26 Oct '11, 10:53) Guy Harris ♦♦

When tcp.stream was implemented, the number had no significance and would show some gaps. In recent (development) versions of Wireshark the number represents order in which wireshark detected tcp streams, the first gets tcp.stream==0, the next tcp.stream==1 etc.

(08 Nov '11, 03:10) SYN-bit ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×349
×178
×166
×82

question asked: 26 Oct '11, 07:42

question was seen: 17,785 times

last updated: 08 Nov '11, 03:10

p​o​w​e​r​e​d by O​S​Q​A