I have captured traffic in Wireshark and I want to follow the TCP stream with most bytes transferred in the traffic.

After opening Statistics > Conversations and sorting by Bytes column I filter the traffic by the two hosts that have most traffic between them (A <-> B). Now I have some 10 000 packets in front of me and I want to follow the TCP stream with most bytes. I have tried picking different packets randomly but just got a couple of smaller streams.


You might want to go back to Statistics > Conversations and then change to the TCP tab.

Once there, you'll get every single TCP conversation separately. Again, sort by bytes, select the first one and click on "Follow Stream" at the bottom right corner of the Statistics window.

| improve this answer | |
  • 1
    Eh right, completely missed that button :-) – Simo Kivistö Feb 17 '15 at 11:01
  • It is just a matter of differentiation between "IP pairs" (sic) and "TCP conversations". On the first one you had the second ones summarized (including also UDP, ICMP, etc) – Pedro Perez Feb 17 '15 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.