Wireshark: follow one conversation

02Open a file, then hide rows

If Wireshark is already available, use File, then Open to select a supplied saved pcapng. Opening an existing file is different from selecting a live interface and recording traffic. No capture privilege or shared-network access is needed for this reading task. If installation is unavailable, continue with the complete transcript.

The display-filter toolbar controls the visible subset. Typing tcp and applying it selects TCP packets. Clearing the filter restores the broader view. This is a viewing operation: the underlying saved records remain available. In these supplied TCP-only files, tcp may leave every row visible, so that unchanged row count is expected.

For a fresh paper filter example, imagine three saved rows: P1 TCP, P2 UDP, P3 TCP. Applying tcp shows P1 and P3. Clearing it shows all three again. Track the visible row list separately from the unchanged three-row saved record.

A capture filter instead selects traffic while recording. The Open dialog can also offer a read filter, which limits loaded records. Saving or exporting a subset is another distinct operation. Do not use any of those as substitutes for the display-filter action named in the question.

To follow a conversation in Wireshark, select one of its TCP packets, then choose Analyze, Follow, TCP Stream. Wireshark applies a display filter for that stream and opens a data dialog. Back can restore the earlier filter. Use endpoint and direction labels rather than relying on display colors, which can vary.

Following traffic does not automatically decrypt encrypted content. TLS, Transport Layer Security, is commonly used to encrypt application traffic. These files contain plain original payloads, with no TLS traffic or decryption keys. A menu capable of following TLS does not establish that application text is readable without the needed keys.

P1  TCP
P2  UDP
P3  TCP

03Read the activity conversation

The activity uses streams-field.pcapng with client port 49160 and listener port 9092. That is a different conversation from the worked file. Identify both endpoints first, then follow the shelf-to-desk direction and predict the response word.

Compare with the transcript's printed check after making your prediction. The retained 2026-10-12 TShark record reports ask plus newline and noted plus newline in that activity file. This historical file read is separate from using a display filter or Follow dialog. You can complete the direction and word reasoning entirely from text.

Follow one conversation by endpoint and direction

A stream groups data in one conversation. Read the addresses and ports
before finding the response word. The two files below are different
conversations, each with a client request and a server response.
The text describes synthetic payloads, not a Follow TCP Stream dialog.

Historical file-read record, 2026-10-12: TShark 4.2.2 read list plus
newline and listed plus newline in streams-demo.pcapng, and ask plus
newline and noted plus newline in streams-field.pcapng. The files are
still synthetic; this is not a live capture or a new execution record.

Fresh paper filter example, separate from those TCP-only files:
Saved rows: P1 TCP, P2 UDP, P3 TCP.
Display filter tcp shows P1 and P3. Clear shows all three again.
The visible subset changed while the saved three-row record stayed.

Synthetic stream transcripts. Not a Follow TCP Stream dialog. The rows describe constructed payloads; the historical read is labeled above.
Each pcapng is separate.

Worked file streams-demo.pcapng
Peers: desk 192.168.50.10 port 49152, shelf 192.168.50.23 port 9090
Setup: SYN, SYN-ACK, ACK
desk to shelf: list
shelf to desk: listed
Predict before reading the check. Check word: listed

Activity file streams-field.pcapng
Peers: desk 192.168.50.10 port 49160, shelf 192.168.50.23 port 9092
Setup: SYN, SYN-ACK, ACK
desk to shelf: ask
shelf to desk: noted
Predict before reading the check. Check word: noted

The serialized payload includes one newline after each word. The check word is the letters.

1. From the worked file, name the shelf-to-desk word. Check word: listed.
2. From the activity file, name the peers, the ports, and the shelf-to-desk word.
3. Check word: noted. The serialized payload includes one newline after the word. The check word is the letters.
4. Stop. Do not start a capture. The question link is the activity file. The transcript is the complete fallback. streams-field.pcapng is the activity file, and the transcript prints it in full. streams-demo.pcapng is the separate worked conversation.

04Optional challenge

Allow about ten extra minutes. Before applying a filter, count conversations in the two supplied transcript sections. Each file describes one. Explain why filtering rows within one file differs from choosing between the two files, and why a visible subset alone cannot count unseen conversations.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Saved records: K1 UDP; K2 TCP; K3 UDP; K4 TCP.
Action: apply the display filter tcp, then clear it. No capture/read filter, save or subset export occurs.

Client iris: 192.0.2.71 port 53214.
Server violet: 192.0.2.72 port 9046.
iris → violet: fetch
violet → iris: delivered
Each word has one trailing LF. This is a supplied text model.

06Explain your prediction

Optional written self-check: Keep viewing, capture selection and export separate. Identify the two endpoints and response direction using labels, and do not claim encrypted content is readable without the required evidence.