Which data stream type is NOT listed as followable in Wireshark in the material?

• A. FTP Stream
• B. UDP Stream
• C. TCP Stream
• D. SSL Stream

Answer: (A)

The idea being tested is how Wireshark’s Follow stream feature works at the transport layer. Wireshark can reconstruct and display the data for conversations that occur over TCP, UDP, or TLS/SSL as separate followable streams. You can follow a TCP stream to see the entire TCP conversation, a UDP stream to see the data exchanged in a UDP conversation, or an SSL/TLS stream to view the data flow related to encrypted TLS sessions (with the caveat that content is decrypted only if you have the keys or are in a version that supports it).

FTP, while it uses TCP, isn’t exposed as its own followable stream type. Instead, FTP traffic is examined by following the underlying TCP stream that carries the FTP commands and responses, and then interpreting those FTP messages within that stream. That’s why FTP Stream isn’t listed as a separate followable option in Wireshark’s follow stream menu.