The Stream Index column displays a unique number for each stream, such as 1 for the first stream, 2 for the second stream, et cetera. A stream is a related collection of TCP packets, typically beginning with the 3-way handshake, then the data transfer, and ending with the session tear down. Adding the Stream Index column lets you see all of the packets from start to end of a session.
- In Wireshark, press Ctrl + Shift + P (or select edit > preferences).
- In the left panel of the preferences pop-up box, select Columns
- At the bottom, Click Add.
- Name the new column stream index.
- Change field type from Number to Custom.
- In field name, enter tcp.stream.
- Click OK.
By default, the stream index column should be in the list of columns. If not, right click on any column, select Displayed Columns and check stream index.
If you want to filter traffic to only display a certain stream, tcp.stream eq x can be used, where x is the stream number.