In Wireshark, which action displays the HTTP conversation for a specific TCP stream and results in a display filter like tcp.stream eq <n>?

• A. Right-click and choose Follow HTTP Stream
• B. Apply display filter tcp.stream eq <n>
• C. Decode As
• D. Follow TCP Stream

Answer: (A)

Following the HTTP conversation is the way to see the complete request and response exchange for a single TCP connection in a neatly formatted view. When you right-click an HTTP packet and choose Follow HTTP Stream, Wireshark reconstructs the application-layer dialogue for that TCP stream and, in the process, applies a display filter like tcp.stream eq so only that stream remains visible in the main timeline. This makes it easy to examine the exact HTTP headers, payloads, and the sequence of requests and responses for that connection.

Other options don’t provide the same combination. Simply applying a display filter tcp.stream eq isolates the stream but doesn’t present the HTTP conversation in its structured, readable form. Decode As changes how a payload is interpreted but doesn’t specifically reconstruct or isolate the HTTP dialogue. Following the TCP Stream shows the raw TCP payload reassembly for a stream, but it isn’t tailored to HTTP and may not automatically present the HTTP conversation with the same focused filter.