Which feature lets you view the full content of a TCP conversation by concatenating packet data?

• A. Reassemble TCP payloads
• B. Analyze stream with TLS decryptor
• C. Follow TCP Stream
• D. Use Packet Bytes

Answer: (C)

Viewing the full content of a TCP conversation hinges on reconstructing the byte stream from multiple packets. TCP splits data into segments that arrive separately, but the original conversation is a continuous sequence of bytes. The feature that does this for you is Follow TCP Stream. It collects the TCP payloads from all packets that belong to one connection, orders them, and presents them as a single, readable view of the entire exchange. You can see what was sent by each side and read through the whole dialogue in one place, which is especially handy for analyzing protocols like HTTP that ride on TCP.

Other options don’t provide this concatenated view. Reassemble TCP payloads is the underlying mechanism used by dissectors to rebuild streams for analysis, but it isn’t presented as a single continuous stream in the UI. TLS decryptor is for decrypting encrypted TLS traffic, not for concatenating payloads. Packet Bytes shows the raw bytes of the currently opened packet, not the entire TCP conversation.