Introduction
Network traffic is often broken down into smaller pieces called packets before being transmitted over a network. When a client and a server communicate, they send many of these packets back and forth. A "stream" represents the complete, ordered sequence of these packets for a single connection.
This packet-versus-stream distinction is one of the most important mindset shifts in protocol analysis. Individual packets show you what happened at a specific instant. Streams show you the full conversation. Many application-layer events such as logins, form submissions, and file transfers make much more sense when you reconstruct the conversation instead of staring at isolated packets one by one.
In this lab, you will learn how to use tshark (the command-line version of Wireshark) to reconstruct these fragmented network conversations. By following complete TCP streams, you will be able to stitch the individual packets back together and view the entire back-and-forth interaction between a client and a server in readable text. This is an essential skill for network troubleshooting and security analysis.
Identify TCP Streams
In this step, you will learn how to identify the different TCP streams present in a network capture file.
When tshark reads a capture file, it automatically groups packets that belong to the same connection (same source IP, source port, destination IP, and destination port) and assigns them a unique integer index. This index is known as the tcp.stream field.
You can think of tcp.stream as a conversation label created by the analyzer. It does not come from the network itself as a protocol field. Instead, tshark infers that certain packets belong together because they share the same connection endpoints and sequence of events. That is why stream analysis is such a useful "analyst view" of the data.
Your environment has already been prepared with a sample capture file named sample_traffic.pcap located in your ~/project directory. This file contains some basic web traffic.
To see all the unique TCP streams in this capture file, you can tell tshark to extract the tcp.stream field from every packet, sort the results, and display only the unique values.
Run the following command in your terminal:
tshark -r sample_traffic.pcap -T fields -e tcp.stream | sort -n | uniq
Let's break down this command:
-r sample_traffic.pcap: Tellstsharkto read the specified capture file.-T fields: Specifies that we want to output specific fields rather than the default packet summary.-e tcp.stream: Tellstsharkto print the TCP stream index for each packet.| sort -n | uniq: Pipes the output to standard Linux utilities to sort the numbers numerically and remove duplicates.
You should see an output similar to this:
0
1
This output indicates that there are two distinct TCP conversations (Stream 0 and Stream 1) recorded in this capture file.
Reconstruct the TCP Stream
Now that you know the index numbers of the TCP streams, you can reconstruct the entire conversation. This process is identical to the "Follow TCP Stream" feature in the Wireshark graphical interface.
Reconstruction is especially valuable for text-based protocols like HTTP, SMTP, and many legacy application protocols because the analyst can read requests and responses in the order the application experienced them. Even when the underlying exchange spans multiple packets, the reconstructed stream restores the narrative.
In this step, we will reconstruct Stream 0. This stream contains an HTTP GET request where a client asked the server for a webpage.
To follow a stream in tshark, you use the -z option, which is used for various statistics and analysis tasks. The specific syntax for following a stream is -z follow,tcp,ascii,<stream_index>.
Execute the following command to reconstruct Stream 0:
tshark -r sample_traffic.pcap -z follow,tcp,ascii,0 -q
Here is what the new arguments mean:
-z follow,tcp,ascii,0: Instructstsharkto follow the TCP stream with index0and display the payload inascii(readable text) format.-q: Stands for "quiet". It suppresses the default per-packet output so that you only see the reconstructed stream data.
You will see an output displaying the complete HTTP conversation:
===================================================================
Follow: tcp,ascii
Filter: tcp.stream eq 0
Node 0: 127.0.0.1:58548
Node 1: 127.0.0.1:8080
GET / HTTP/1.1
Host: localhost:8080
User-Agent: curl/7.81.0
Accept: */*
HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/3.10.12
Date: Thu, 05 Mar 2026 02:00:48 GMT
Content-type: text/html
Content-Length: 40
Last-Modified: Thu, 05 Mar 2026 02:00:44 GMT
Welcome to the LabEx Network Stream Lab
===================================================================
In this output, you can clearly see the client's request (GET / HTTP/1.1...) followed immediately by the server's response (HTTP/1.0 200 OK... and the HTML content). tshark has successfully stitched the individual packets back together into a coherent text block.
Analyze the Conversation
When analyzing network traffic, conversations can be very long. Printing a massive stream directly to the terminal can make it difficult to read and analyze.
Saving the reconstructed stream to a file is a small step, but it reflects a broader forensic habit: preserve intermediate analysis artifacts. Investigators often keep notes, extracted conversations, decoded payloads, and filtered evidence as separate files so findings can be reviewed, compared, or handed to someone else without repeating the same commands from scratch.
In this step, you will reconstruct Stream 1 and redirect the output into a text file. This allows you to use standard text editors or command-line tools to inspect the conversation at your own pace.
Stream 1 contains an HTTP POST request, which is typically used when submitting data, such as a login form.
Run the following command to follow Stream 1 and save the output to a file named stream1_analysis.txt:
tshark -r sample_traffic.pcap -z follow,tcp,ascii,1 -q > stream1_analysis.txt
The > operator takes the output that would normally print to your screen and writes it into stream1_analysis.txt in your current directory (~/project).
Now, use the cat command to view the contents of the file you just created:
cat stream1_analysis.txt
Your output should look similar to this:
===================================================================
Follow: tcp,ascii
Filter: tcp.stream eq 1
Node 0: 127.0.0.1:45138
Node 1: 127.0.0.1:8080
POST /login HTTP/1.1
Host: localhost:8080
User-Agent: curl/7.81.0
Accept: */*
Content-Length: 23
Content-Type: application/x-www-form-urlencoded
user=labex&action=loginHTTP/1.0 501 Unsupported method ('POST')
Server: SimpleHTTP/0.6 Python/3.10.12
Date: Wed, 25 Oct 2026 10:00:05 GMT
Connection: close
Content-Type: text/html;charset=utf-8
Content-Length: 480
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
...
===================================================================
By analyzing this file, you can observe the exact data the client sent in the POST request body (user=labex&action=login). You can also see the server's response, which in this case is a 501 Unsupported method error, indicating that the simple Python web server used to generate this traffic does not support POST requests.
Saving streams to files is a highly effective technique when you need to extract files, credentials, or detailed logs from network captures.
Summary
Congratulations! You have successfully completed the Following Network Streams lab.
In this lab, you learned how to:
- Identify unique TCP streams within a packet capture file using the
tcp.streamfield. - Reconstruct and view the complete back-and-forth conversation of a specific TCP stream using
tshark'sfollowfeature. - Redirect reconstructed stream data into text files for easier reading and deeper analysis.
These techniques are fundamental for network administrators and security professionals when investigating network issues, analyzing malware behavior, or verifying application communications.
