How can I isolate a single TCP connection on Wireshark?
I just started using Wireshark for network troubleshooting purposes and I am a little confused about one thing. I requested a webpage and for the next 10s I monitored the data. I then used the filter to display all of the TCP packets. I have a list of around 20 TCP packets. Now I want to isolate only the packets that correspond to a single TCP connection of the webpage request and response. How can I do that?
Solution 1:
A single unique TCP connection is a unique set of four properties, destination ip-address + destination port & source IP-address + source port. So isolate those four in a sample packet and create a display filter to restrict your display to packets that match.
Or do the simple thing: right-click a packet of interest and choose "Follow TCP Stream".