Following Streams

Follow a Conversation

Right-click any packet → Follow → pick a protocol, or use Analyze → Follow → TCP Stream. Wireshark reassembles the byte stream in both directions and drops a tcp.stream eq N filter into the bar.

Colors in the follow window: red is client to server, blue is server to client. The dropdown at the bottom switches to one direction only, which is what you want when reading a protocol transcript.

Output Modes

Save as… writes the current mode to a file. In Raw mode that gives you the exact bytes back, which is the way to extract a file that Wireshark has no dissector for.

# Same thing from the command line, no GUI
tshark -r cap.pcapng -z follow,tcp,ascii,0 -q
tshark -r cap.pcapng -z follow,tcp,hex,1 -q
tshark -r cap.pcapng -z follow,http,ascii,3 -q
tshark -r cap.pcapng -z "follow,tcp,raw,10.0.0.5:54321,93.184.216.34:80" -q

The stream selector takes three shapes: ip:port,ip:port, a bare stream index, or stream,substream for multiplexed transports like HTTP/2 and QUIC. Stream indices are zero-based, so follow,tcp,ascii,1 is the second connection.

Finding the Stream You Want

You rarely know the stream index up front. Work backwards from something you can search for.

# Every stream index with the ports and byte counts
tshark -r cap.pcapng -q -z conv,tcp

# Streams that carried a given hostname, then follow one
tshark -r cap.pcapng -Y 'http.host == "api.example.com"' \
  -T fields -e tcp.stream | sort -un

# Streams that saw a reset
tshark -r cap.pcapng -Y "tcp.flags.reset == 1" \
  -T fields -e tcp.stream | sort -un

# The stream carrying a string anywhere in the payload
tshark -r cap.pcapng -Y 'tcp contains "authorization"' \
  -T fields -e tcp.stream | sort -un

In the GUI, Ctrl+F opens Find Packet. Set it to search Packet bytes for a String and it will land you on the frame, then follow from there. Searching Packet details for a string matches the dissected field text instead, which is better for finding a status code or a header name.

Reassembly and Its Limits

Following a stream depends on TCP reassembly, and reassembly depends on having all the segments.

- Missing segments show as [Packet size limited during capture] or a gap in the follow window. A short snaplen (-s 96) truncates payload, so the follow window will be mostly empty even though the packet list looks complete. - Out of order and retransmitted segments are handled, and duplicate bytes are not shown twice. Run reordercap first if timestamps are shuffled by a multi-interface merge. - A capture that starts mid-connection has no SYN, so Wireshark does not know the initial sequence number and relative sequence numbering is off. Check tcp.completeness to see whether a stream has SYN, data, and FIN. - Compression and chunking are undone for HTTP but not for arbitrary protocols. Follow HTTP Stream, not TCP Stream, when the body is gzipped. - TLS shows ciphertext unless keys are loaded. Follow TLS Stream after setting up a key log file, see the TLS decryption topic.

Preferences that change what you see, under Preferences → Protocols:

Extract Files and Objects

Reassembled payloads can be carved out whole. File → Export Objects lists every object the dissector recovered, with its host, content type, size, and filename.

mkdir -p out
tshark -r cap.pcapng --export-objects http,out -q
ls out

For a protocol with no export support, select the reassembled bytes in the packet detail pane, right-click → Export Packet Bytes and save. Pick the reassembled tab at the bottom of the byte pane, not the single-frame tab, or you get one segment instead of the whole payload. The full protocol list is tshark --export-objects help.

Exported objects come from untrusted traffic. Treat anything you carve out of a capture as hostile input and do not open it on the analysis machine.