1

I have captured traffic in Wireshark and I want to follow the TCP stream with most bytes transferred in the traffic.

After opening Statistics > Conversations and sorting by Bytes column I filter the traffic by the two hosts that have most traffic between them (A <-> B). Now I have some 10 000 packets in front of me and I want to follow the TCP stream with most bytes. I have tried picking different packets randomly but just got a couple of smaller streams.

1 Answer 1

1

You might want to go back to Statistics > Conversations and then change to the TCP tab.

Once there, you'll get every single TCP conversation separately. Again, sort by bytes, select the first one and click on "Follow Stream" at the bottom right corner of the Statistics window.

2
  • 1
    Eh right, completely missed that button :-) Feb 17, 2015 at 11:01
  • It is just a matter of differentiation between "IP pairs" (sic) and "TCP conversations". On the first one you had the second ones summarized (including also UDP, ICMP, etc) Feb 17, 2015 at 11:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .