Wireshark · Wireshark-users: Re: [Wireshark-users] opening caoture files after applying follow tcp stream

[Abhik Sarkar <sarkar.abhik@xxxxxxxxx>]

If you saved the file from the "Follow TCP Stream" dialog, you saved only the stream data (read this page: http://www.wireshark.org/docs/wsug_html_chunked/ChAdvFollowTCPSection.html)

If you want to save only the packets of a particular stream, do a "Follow TCP stream", then close the "Follow TCP Stream" dialog... you will find that a display filter has been applied to show you only frames matching that TCP stream. Then select File > Save As and select "Displayed" and "All Packets" in the "Packet Range" options. That will result in a tcpdump capture file containing only the stream of your interest which you can subsequently open in Wireshark.

HTH
Abhik

On Fri, Apr 24, 2009 at 1:45 PM, ram singh <ramsingh.600@xxxxxxxxx> wrote:

hi...
can any1 pl help in opening a saved file after applying tcp stream in wireshark.. its very urgent... can any1 pl help

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe