How can I easily locate a specific TCP conversation in two separate (and large) packet captures using wireshark?

Occasionally, I'll need to compare packet captures (usually wireshark or tcpdump) that are collected from both sides of a TCP conversation. Sometimes the two hosts involved are very "chatty" so I'll need to narrow down the capture to just a specific session.

I'll usually do this by looking in the details column of wireshark for something that looks familiar, right-clicking on that packet, and selecting Follow TCP Stream. That's all well and good, but how can I find the same equivalent stream in the other packet capture? Does WireShark support searching for a stream ID of some sort?


Statistics, Conversations seems very similar to what you want, there you can do "Apply as filter" to the streams in there.

If you know the stream index number you can put in the filter: tcp.stream eq 5

You should check out ask.wireshark.org where I found:

How does Wireshark calculate the TCP stream index?

How can I view stream lists


Assuming you're using TCP, the source port is usually unique enough for tracing in known periods. I would load the first capture in Wireshark, then go to File -> Merge to get both ends of the trace to be listed next to each other. Ensure "Merge packets chronologically" is selected.

Then find one of the packets that looks interesting. Depending on the direction, the unique source port or destination port will probably be between 49152 to 65535.

Then in the filter box in the main screen, type tcp.port == 49152, where 49152 is your unique port.