Wireshark - Add the Stream index column

The Stream Index column displays a unique number for each stream, such as 1 for the first stream, 2 for the second stream, et cetera. A stream is a related collection of TCP packets, typically beginning with the 3-way handshake, then the data transfer, and ending with the session tear down. Adding the Stream Index column lets you see all of the packets from start to end of a session.

  1. In Wireshark, press Ctrl + Shift + P (or select edit >  preferences).
  2. In the left panel of the preferences pop-up box, select Columns
  3. At the bottom, Click Add.
  4. Name the new column stream index.
  5. Change field type from Number to Custom.
  6. In field name, enter tcp.stream.
  7. Click OK.

By default, the stream index column should be in the list of columns. If not, right click on any column, select Displayed Columns and check stream index.

If you want to filter traffic to only display a certain stream, tcp.stream eq x can be used, where x is the stream number.

Did you find this article helpful?

If so, consider buying me a coffee over at Buy Me A Coffee

Add a Comment

We will never share your name or email with anyone. Enter your email if you would like to be notified when we respond to your comment.

Please enter f30f5 in the box below so that we can be sure you are a human.


August 5th, 2022 by Aj