7.2. Following TCP streams

Wireshark 2.1

7.2. Following TCP streams

[Tip] Tip

7.2.1. The “Follow TCP Stream” dialog box

wsug_graphics/ws-follow-stream.png
  1. Save As: Save the stream data in the currently selected format.
  2. Print: Print the stream data in the currently selected format.
  3. Direction: Choose the stream direction to be displayed (“Entire conversation”, “data from A to B only” or “data from B to A only”).
  4. Filter out this stream: Apply a display filter removing the current TCP stream data from the display.
  5. Close: Close this dialog box, leaving the current display filter in effect.
  1. ASCII: In this view you see the data from each direction in ASCII. Obviously best for ASCII based protocols, e.g. HTTP.
  2. EBCDIC: For the big-iron freaks out there.
  3. HEX Dump: This allows you to see all the data. This will require a lot of screen space and is best used with binary protocols.
  4. C Arrays: This allows you to import the stream data into your own C program.
  5. Raw: This allows you to load the unaltered stream data into a different program for further examination. The display will look the same as the ASCII setting, but “Save As” will result in a binary file.