Which path specifically displays TLS segments on the same TLS connection as a selected packet?

• A. Analyze ->Follow -> TLS Stream
• B. Analyze ->Follow -> SSL Stream
• C. Right click -> Follow UDP Stream
• D. Analyze -> Expert Info

Answer: (A)

Following the TLS Stream reconstructs the entire conversation for the specific TLS connection you’ve selected. When you pick a TLS packet and choose Analyze -> Follow -> TLS Stream, Wireshark gathers all packets that belong to that same TLS session (the same TCP connection and TLS exchange) and presents the data in order. This gives you the complete transcript of that TLS exchange—handshake messages and any application data seen—so you can see exactly how that particular TLS connection unfolds.

The other options don’t target the TLS conversation in the same way: Follow SSL Stream is an older label for the same idea in older versions, Follow UDP Stream is for UDP-based streams (TLS typically runs over TCP, or would be DTLS for UDP, which is a different case), and Expert Info is a general diagnostic view rather than a way to reconstruct a TLS data stream.