Wireshark-users: Re: [Wireshark-users] Follow TCP conversation question
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Fri, 13 Jun 2014 12:00:50 -0400
On 06/13/14 10:59, Perry Smith wrote:

When I "Follow TCP Conversation", I get another window with the text of the conversation which I don't need.  I just want to set the filter.  One reason is it takes a long time to create the window sometimes.  Is there a way to do that?
So you just want to get the "tcp.stream eq X" filter (where you don't know the value of X), right? 

To do that without using the "Follow" UI, just:
1) Open the TCP section in the packet-decode (middle) pane of the packet you're interested in 

2) Find the item that says "[Stream index: X]"

3) Right-click and select "Apply as filter"
(I think the decode item mentioned in (2) may not be present in older versions of Wireshark; if you don't see it, try upgrading.)