7.2. Following TCP streams
If you are working with TCP based protocols it can be
very helpful to see the data from a TCP stream in the way that
the application layer sees it. Perhaps you are looking for
passwords in a Telnet stream, or you are trying to make sense
of a data stream. Maybe you just need a display filter to show
only the packets of that TCP stream. If so, Wireshark's ability
to follow a TCP stream will be useful to you.
Simply select a TCP packet in the packet list of the
stream/connection you are interested in and then select the
Follow TCP Stream menu item from the Wireshark Tools menu (or
use the context menu in the packet list). Wireshark will set an
appropriate display filter and pop up a dialog box with all the
data from the TCP stream laid out in order, as shown in
Figure 7.1, “The "Follow TCP Stream" dialog box”.
![[Note]](wsug_graphics/note.png)
|
Note! |
|
It is worthwhile noting that Follow TCP Stream installs
a display filter to select all the packets in the TCP stream
you have selected.
|
7.2.1. The "Follow TCP Stream" dialog box
The stream content is displayed in the same sequence as
it appeared on the network. Traffic from A to B is marked in
red, while traffic from B to A is marked in blue. If you
like, you can change these colors in the Edit/Preferences
"Colors" page.
Non-printable characters will be replaced by dots. XXX
- What about line wrapping (maximum line length) and CRNL
conversions?
The stream content won't be updated while doing a live
capture. To get the latest content you'll have to reopen the
dialog.
You can choose from the following actions:
-
Save As
: Save the stream data in the
currently selected format.
-
Print
: Print the stream data in the
currently selected format.
-
Direction
: Choose the stream direction
to be displayed ("Entire conversation", "data from A to B
only" or "data from B to A only").
-
Filter out this stream
: Apply a display
filter removing the current TCP stream data from the
display.
-
Close
: Close this dialog box, leaving
the current display filter in effect.
You can choose to view the data in one of the following
formats:
-
ASCII
: In this view you see the data
from each direction in ASCII. Obviously best for ASCII
based protocols, e.g. HTTP.
-
EBCDIC
: For the big-iron freaks out
there.
-
HEX Dump
: This allows you to see all
the data. This will require a lot of screen space and is
best used with binary protocols.
-
C Arrays
: This allows you to import
the stream data into your own C program.
-
Raw
: This allows you to load the
unaltered stream data into a different program for
further examination. The display will look the same as
the ASCII setting, but "Save As" will result in a binary
file.
