Follow Techotopia on Twitter

On-line Guides
All Guides
eBook Store
iOS / Android
Linux for Beginners
Office Productivity
Linux Installation
Linux Security
Linux Utilities
Linux Virtualization
Linux Kernel
System/Network Admin
Scripting Languages
Development Tools
Web Development
GUI Toolkits/Desktop
Mail Systems
Eclipse Documentation

How To Guides
General System Admin
Linux Security
Linux Filesystems
Web Servers
Graphics & Desktop
PC Hardware
Problem Solutions
Privacy Policy




7.2. Following TCP streams

If you are working with TCP based protocols it can be very helpful to see the data from a TCP stream in the way that the application layer sees it. Perhaps you are looking for passwords in a Telnet stream, or you are trying to make sense of a data stream. Maybe you just need a display filter to show only the packets of that TCP stream. If so, Wireshark's ability to follow a TCP stream will be useful to you.

Simply select a TCP packet in the packet list of the stream/connection you are interested in and then select the Follow TCP Stream menu item from the Wireshark Tools menu (or use the context menu in the packet list). Wireshark will set an appropriate display filter and pop up a dialog box with all the data from the TCP stream laid out in order, as shown in Figure 7.1, “The "Follow TCP Stream" dialog box”.

[Note] Note!

It is worthwhile noting that Follow TCP Stream installs a display filter to select all the packets in the TCP stream you have selected.

7.2.1. The "Follow TCP Stream" dialog box

Figure 7.1. The "Follow TCP Stream" dialog box

The "Follow TCP Stream" dialog box

The stream content is displayed in the same sequence as it appeared on the network. Traffic from A to B is marked in red, while traffic from B to A is marked in blue. If you like, you can change these colors in the Edit/Preferences "Colors" page.

Non-printable characters will be replaced by dots. XXX - What about line wrapping (maximum line length) and CRNL conversions?

The stream content won't be updated while doing a live capture. To get the latest content you'll have to reopen the dialog.

You can choose from the following actions:

  1. Save As : Save the stream data in the currently selected format.

  2. Print : Print the stream data in the currently selected format.

  3. Direction : Choose the stream direction to be displayed ("Entire conversation", "data from A to B only" or "data from B to A only").

  4. Filter out this stream : Apply a display filter removing the current TCP stream data from the display.

  5. Close : Close this dialog box, leaving the current display filter in effect.

You can choose to view the data in one of the following formats:

  1. ASCII : In this view you see the data from each direction in ASCII. Obviously best for ASCII based protocols, e.g. HTTP.

  2. EBCDIC : For the big-iron freaks out there.

  3. HEX Dump : This allows you to see all the data. This will require a lot of screen space and is best used with binary protocols.

  4. C Arrays : This allows you to import the stream data into your own C program.

  5. Raw : This allows you to load the unaltered stream data into a different program for further examination. The display will look the same as the ASCII setting, but "Save As" will result in a binary file.

  Published under the terms fo the GNU General Public License Design by Interspire