If you want to isolate all packets belonging to a single TCP connection in Wireshark, which technique would you use?

• A. Apply a filter using the tcp.stream index for the desired stream
• B. Filter by IP address alone
• C. Filter by port only
• D. Filter by protocol only

Answer: (A)

Focusing on the TCP stream index lets you group all packets that belong to the same TCP conversation. Wireshark assigns a unique stream number to every distinct TCP connection, and every packet from that connection carries the same tcp.stream value. Filtering with that stream number (for example, tcp.stream eq 1) isolates exactly that connection’s entire packet sequence—from the handshake through termination. You can identify the correct stream by using Follow TCP Stream or by inspecting the tcp.stream field in a packet’s details.

Other common filters aren’t as precise: filtering by IP address may include multiple connections using the same address, filtering by port can mix different conversations using the same port, and filtering by protocol would show all TCP traffic, not just one connection.