Which path opens a window displaying all TCP segments on the same TCP connection as a selected packet?

• A. Analyze ->Follow -> TCP Stream
• B. Analyze ->Follow -> HTTP Stream
• C. Analyze -> Decode As
• D. Right click -> Follow UDP Stream

Answer: (A)

Following the TCP stream is the way to see the entire conversation that belongs to a single TCP connection. In Wireshark, select a packet and choose Analyze > Follow > TCP Stream. That opens a window that collects all TCP segments sharing the same connection (same source/destination IP and ports) and reassembles them in order, showing the full bidirectional data exchanged between the two endpoints. It reveals the complete stream of bytes, making it easy to inspect the payloads from both sides in one place, rather than looking at individual packets in isolation.

This is different from following an HTTP stream, which focuses on the HTTP-level messages that ride atop TCP and won’t necessarily display the raw TCP segments or non-HTTP data. It’s also not applicable to UDP, where you’d use Follow UDP Stream. And Decode As only changes how a payload is interpreted, not which packets belong to a TCP connection.