ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] opening caoture files after applying follow tcp stream

From: Abhik Sarkar <sarkar.abhik@xxxxxxxxx>
Date: Sat, 25 Apr 2009 00:38:57 +0400
If you saved the file from the "Follow TCP Stream" dialog, you saved only the stream data (read this page: http://www.wireshark.org/docs/wsug_html_chunked/ChAdvFollowTCPSection.html)

If you want to save only the packets of a particular stream, do a "Follow TCP stream", then close the "Follow TCP Stream" dialog... you will find that a display filter has been applied to show you only frames matching that TCP stream. Then select File > Save As and select "Displayed" and "All Packets" in the "Packet Range" options. That will result in a tcpdump capture file containing only the stream of your interest which you can subsequently open in Wireshark.

HTH
Abhik

On Fri, Apr 24, 2009 at 1:45 PM, ram singh <ramsingh.600@xxxxxxxxx> wrote:
hi...
can any1 pl help in opening a saved file after applying tcp stream in wireshark.. its very urgent... can any1 pl help

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe