Which path opens a window showing all the HTTP segments on the same HTTP connection as a selected packet?

• A. Analyze ->Follow -> HTTP Stream
• B. Analyze ->Follow -> SSL Stream
• C. Right click -> Follow TCP Stream
• D. Analyze -> Decode As

Answer: (A)

Viewing the HTTP conversation at the application level is done by following the HTTP stream. This path reconstructs the HTTP messages for the connection that the selected packet belongs to and presents all the HTTP requests and responses in sequence, including headers and bodies, in a readable stream. It’s the best way to see the full HTTP exchange on that specific connection without getting into the raw TCP bytes or other protocols.

Using SSL Stream would only help if the traffic were encrypted TLS, in which case you wouldn’t see readable HTTP data. Following TCP Stream shows the raw TCP bytes of the connection and can include HTTP text, but it isn’t specialized for HTTP formatting and headers. Decode As is used to reinterpret payloads as a different protocol and doesn’t provide the consolidated HTTP conversation view.