Wireshark-users: Re: [Wireshark-users] what does the TCP stream mean in wireshark
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Martin Visser <martinvisser99@xxxxxxxxx>
Date: Wed, 23 May 2012 20:48:29 +1000
Nangergong,

A TCP stream is a single connection between two IP addresses, between the two same ports. If you see the beginning you'll see the SYN-SYN/ACK-ACK handshake, an will also see the sequence numbers increasing. Some protocols like HTTP/1.1 can have multiple higher level conversations on the one connection, so I am not sure that is what you might be seeing?

Regards, Martin

MartinVisser99@xxxxxxxxx


On 23 May 2012 20:28, nangergong <nangergong@xxxxxxxxx> wrote:
HI, all:

    In wireshark there is an option "Follow the TCP stream", I'm wondering what does it mean? it seems that in such a TCP stream there are multiple TCP connections.

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe