Which display filter in Wireshark selects packets belonging to a specific TCP stream by index?

• A. tcp.stream eq <index>
• B. tcp.port eq 80
• C. ip.addr == x.x.x.x
• D. http.request

Answer: (A)

To isolate all packets from one TCP conversation, filter on the TCP stream index. Each TCP connection in Wireshark gets a stream number exposed as the field tcp.stream. Using tcp.stream eq shows every packet that belongs to that specific TCP stream, giving you exactly the packets from that one connection.

Other filters don’t target the stream: tcp.port eq 80 narrows traffic to port 80 (HTTP in general, across many streams), ip.addr == x.x.x.x filters packets involving a particular IP (again across streams), and http.request filters only HTTP requests, which can come from multiple TCP streams.