What does the tcp.stream index represent?

• A. It identifies a single TCP conversation; all packets in that stream share the same index
• B. It identifies a packet's position in the overall capture
• C. It is the TCP sequence number modulo
• D. It is the order in which captures were started

Answer: (A)

tcp.stream is a unique identifier that Wireshark assigns to group all packets that belong to the same TCP conversation. Each TCP connection between two endpoints gets its own stream index, and every packet that participates in that connection carries the same index. This lets you isolate and analyze a single dialogue in the trace, even when packets from multiple connections are interleaved.

This index is not the packet’s position in the capture—that would be the frame number. It’s also not the TCP sequence number (or a modulo of it), which relates to data ordering within a single connection, nor is it the order in which captures were started. The stream index’s purpose is to denote the entire TCP conversation, with all its packets sharing that single identifier.