Re: Follow TCP conversation question

[Perry Smith <pedzsan () gmail com>]

On Jun 13, 2014, at 11:00 AM, Jeff Morriss <jeff.morriss.ws () gmail com> wrote:

> On 06/13/14 10:59, Perry Smith wrote:
> > When I "Follow TCP Conversation", I get another window with the text of the conversation which I don't need.  I just 
> > want to set the filter.  One reason is it takes a long time to create the window sometimes.  Is there a way to do 
> > that?
>
> So you just want to get the "tcp.stream eq X" filter (where you don't know the value of X), right?
>
> To do that without using the "Follow" UI, just:
>
> 1) Open the TCP section in the packet-decode (middle) pane of the packet you're interested in
>
> 2) Find the item that says "[Stream index: X]"
>
> 3) Right-click and select "Apply as filter"
>
> (I think the decode item mentioned in (2) may not be present in older versions of Wireshark; if you don't see it, try 
> upgrading.)

I see it!  Thanks.  That's exactly what I was looking for.  Seems like that would be much easier to do as well.

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe