Advanced Features
7.2. Following TCP streams
There will be occasions when you would like to see the data from a TCP session in the order that the application layer sees it. Perhaps you are looking for passwords in a Telnet stream, or you are trying to make sense of a data stream. If so, Ethereal's ability to follow a TCP stream will be useful to you.
Simply select a TCP packet in the stream/connection you are interested in and then select the Follow TCP Stream menu item from the Ethereal Tools menu. Ethereal will pop up a separate window with all the data from the TCP stream laid out in order, as shown in Figure 7.1, “The "Follow TCP Stream" dialog box”.
7.2.1. The "Follow TCP stream" dialog box
Figure 7.1. The "Follow TCP Stream" dialog box
You can choose from the following actions:
1.Save As Save the stream data in the currently selected format.
2.Print Print the stream data in the currently selected format.
3.Direction Choose the stream direction to be displayed ("Entire conversation", "data from A to B only" or "data from B to A only").
4.Filter out this stream Apply a display filter removing the current TCP stream data from the display.
5.Close Close this dialog box.
121
