Follow one conversation by endpoint and direction

A stream groups data in one conversation. Read the addresses and ports
before finding the response word. The two files below are different
conversations, each with a client request and a server response.
The text describes synthetic payloads, not a Follow TCP Stream dialog.

Historical file-read record, 2026-10-12: TShark 4.2.2 read list plus
newline and listed plus newline in streams-demo.pcapng, and ask plus
newline and noted plus newline in streams-field.pcapng. The files are
still synthetic; this is not a live capture or a new execution record.

Fresh paper filter example, separate from those TCP-only files:
Saved rows: P1 TCP, P2 UDP, P3 TCP.
Display filter tcp shows P1 and P3. Clear shows all three again.
The visible subset changed while the saved three-row record stayed.

Synthetic stream transcripts. Not a Follow TCP Stream dialog. The rows describe constructed payloads; the historical read is labeled above.
Each pcapng is separate.

Worked file streams-demo.pcapng
Peers: desk 192.168.50.10 port 49152, shelf 192.168.50.23 port 9090
Setup: SYN, SYN-ACK, ACK
desk to shelf: list
shelf to desk: listed
Predict before reading the check. Check word: listed

Activity file streams-field.pcapng
Peers: desk 192.168.50.10 port 49160, shelf 192.168.50.23 port 9092
Setup: SYN, SYN-ACK, ACK
desk to shelf: ask
shelf to desk: noted
Predict before reading the check. Check word: noted

The serialized payload includes one newline after each word. The check word is the letters.