All geek questions in one place

Follow the tcp stream - Where does the Stream Index field come from?

Wireshark has a feature called "follow tcp stream", under the "Analyze" menu item.

When I use it, a screen capture filter is created, for example:

tcp.stream eq 1

Where does this index come from?

I can not find any field in the package containing it ...

+6
source share
2 answers

the stream index is an internal Wireshark conversion for: [IP address A, TCP port A, IP address B, TCP port B]

All packets for the same tcp.stream value must have the same values ​​for these fields (although src / dest will be switched for packets A-> B and B-> A)

see the Statistics / Conversations / TCP tab in Wireshark for a summary of these flows

+10
source

Thread indices are internal Wireshark. It simply uses a number to uniquely identify a TCP stream.

+2
source

Source: https://habr.com/ru/post/888670/

More articles:


All Articles