How to add the Stream index column in Wireshark

Home > Search > How-to
  by

The Stream Index column displays a unique number for each stream, such as 1 for the first stream, 2 for the second stream, et cetera. A stream is a related collection of TCP packets, typically beginning with the 3-way handshake, then the data transfer, and ending with the session tear down. Adding the Stream Index column lets you see all of the packets from start to end of a session.

  1. In Wireshark, press Ctrl + Shift + P (or select edit >  preferences).
  2. In the left panel of the preferences pop-up box, select Columns
  3. At the bottom, Click Add.
  4. Name the new column stream index.
  5. Change field type from Number to Custom.
  6. In field name, enter tcp.stream.
  7. Click OK.

By default, the stream index column should be in the list of columns. If not, right click on any column, select Displayed Columns and check stream index.

If you want to filter traffic to only display a certain stream, tcp.stream eq x can be used, where x is the stream number.



Add a Comment




We will never share your name or email with anyone. Enter your email if you would like to be notified when we respond to your comment.




Please enter in the box below so that we can be sure you are a human.




Comments