What is the purpose of the Follow HTTP Stream feature?

• A. To export to CSV
• B. To start a new capture
• C. To view the reconstructed HTTP conversation payload
• D. To filter by protocol

Answer: (C)

Follow HTTP Stream is designed to show the complete HTTP conversation in a single, readable view. HTTP messages travel across many TCP packets, and they can be split, delayed, or interleaved with other traffic. Wireshark reconstructs the TCP stream for that HTTP connection and presents the client request and the server response in the order they occurred, including both headers and body. This lets you clearly see exactly what the client sent (such as the method, requested URL, headers, and any POST data) and what the server replied (status line, headers, and body), without manually piecing together individual packets. It’s especially helpful for debugging HTTP sessions, tracing how redirects were handled, inspecting cookies, forms, or payloads, and understanding how chunked or compressed content is delivered. It’s not about exporting data to CSV, starting a new capture, or filtering by protocol; those are separate functions.