Which Wireshark feature reconstructs the data stream for a TCP connection and shows the conversation?

• A. Follow TCP Stream
• B. Decode As
• C. Follow HTTP Stream
• D. Apply Filter

Answer: (A)

Reassembling the data stream from a TCP connection and displaying the full conversation between the endpoints is what this feature does. It gathers all TCP segments that belong to a single connection (identified by the two IP addresses and ports), orders them by sequence numbers, handles gaps and retransmissions, and presents the payload in the exact order it was sent. This lets you see the entire back-and-forth as a continuous dialogue, including what each side sent and received, across the whole TCP session.

This is especially useful for debugging how an application-layer protocol is exchanging data, since you can observe the complete stream rather than piecing together fragments manually. Other options serve different purposes: decoding changes how a packet’s payload is interpreted without reconstructing the stream; a HTTP-specific follow view reconstructs only the HTTP conversation within a TCP connection; applying a filter merely narrows the displayed packets without reassembling any data. To use it, pick a TCP packet and choose the option to follow the TCP stream.