Follow tcp stream - Where does field "Stream index" come from?
28,595
Solution 1
the stream index is an internal Wireshark mapping to: [IP address A, TCP port A, IP address B, TCP port B]
All the packets for the same tcp.stream value should have the same values for these fields (though the src/dest will be switched for A->B and B->A packets)
see the Statistics/Conversations/TCP tab in Wireshark to show a summary of these streams
Solution 2
Stream indexes are Wireshark-internal. It just uses a number to uniquely identify a TCP stream.
Author by
pcent
Updated on May 21, 2020Comments
-
pcent about 4 years
Wireshark has a that feature called "follow tcp stream", under the menu item "Analyze".
When I use it, a screen capture filter is generated, something like:
tcp.stream eq 1
Where does this index come from?
I can't find any field in the packet that contains it...