Wireshark · Wireshark-users: Re: [Wireshark-users] Follow TCP conversation question

[Perry Smith <pedzsan@xxxxxxxxx>]

On Jun 13, 2014, at 11:00 AM, Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> wrote:

> On 06/13/14 10:59, Perry Smith wrote:
>> When I "Follow TCP Conversation", I get another window with the text of the conversation which I don't need.  I just want to set the filter.  One reason is it takes a long time to create the window sometimes.  Is there a way to do that?
> 
> So you just want to get the "tcp.stream eq X" filter (where you don't know the value of X), right?
> 
> To do that without using the "Follow" UI, just:
> 
> 1) Open the TCP section in the packet-decode (middle) pane of the packet you're interested in
> 
> 2) Find the item that says "[Stream index: X]"
> 
> 3) Right-click and select "Apply as filter"
> 
> (I think the decode item mentioned in (2) may not be present in older versions of Wireshark; if you don't see it, try upgrading.)
> 

I see it!  Thanks.  That's exactly what I was looking for.  Seems like that would be much easier to do as well.

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail