Which menu item allows forcing Wireshark to decode packets as a particular protocol?

• A. Analyze -> Decode As
• B. Analyze ->Follow -> TCP Stream
• C. Right click -> Follow SSL Stream
• D. Analyze -> Expert Info

Answer: (A)

You can control how Wireshark interprets the bytes by forcing a specific protocol through the Decode As option. This is found under the Analyze menu. Decode As lets you choose a protocol and apply that decoding rule to the selected packet(s) or to packets that match certain criteria (like a particular port). It’s especially handy when data on a given port doesn’t actually use the protocol Wireshark would normally associate with that port, or when you’re dealing with a nonstandard or proprietary format embedded in the trace. Once you set Decode As, Wireshark uses that protocol’s dissector to decode the payload, so you’ll see the relevant fields and streams for accurate analysis.

Follow TCP Stream and Follow SSL Stream are about reassembling and viewing the data in a readable form for a specific connection or TLS session, not about changing which protocol Wireshark uses to decode the payload. Expert Info shows analysis results and notable events, not how the payload is decoded.