Wireshark · Wireshark-users: Re: [Wireshark-users] Sort by conversation

[Hansang Bae <hbae@xxxxxxxxxx>]

Rob Heilman wrote:
> Is there a way to sort by session and still display all the sessions at 
> the same time?

I don't believe so.  You will have to use "follow tcp" or prepare a 
filter based on the src/dst ports and save them off as individual files. 
 Don't forget to check the "displayed" bullet when saving the filtered 
traces.

One thing, when you apply a display filter, you can quickly look at the 
conversation, then clear the filter to look at other conversations. 
When you save it off, you lose the original packet numbers, so you'll 
have to reference it via absolute timestamp field.

--

Thanks,
Hansang