Following a TCP stream in Wireshark
You learn to read conversation by conversation instead of packet by packet: the tcp.stream number, Follow TCP and HTTP Stream, client and server colours, saving one direction only, FTP’s control and data connections; you find credentials and a session cookie sent unencrypted, carve a transferred file out of the capture and write a findings report so the passwords get changed.
Level 101 · 50 min
An alert reached the SOC: a workstation connects to the company portal and the file server with unencrypted protocols. Daniel gave you the capture: ~/ws/akis.pcapng. "Don’t read the packets one by one; read the conversations from start to end," he says.
In TCP, data is split over many packets. Wireshark gives the packets of one connection a stream number (tcp.stream) and Follow TCP Stream joins all data in that stream into one text: what the client said in red, the server’s answers in blue. It is like reading the transcript of a phone call.
Your goal is defensive: find passwords sent unencrypted and report them so they can be changed. Don’t use any credential you find. Close any Wireshark windows left open from earlier lessons: the desktop runs with 2 GB of memory.
What you will do in this lesson
- Open the capture and see the streams
- Follow TCP Stream
- Follow HTTP Stream: the portal logon
- Only what the client said
- The FTP credentials
- Carve out the transferred file
- The session cookie
- How many conversations?
- The findings report
- Short quiz
Skills you will earn
- Opening a capture file in Wireshark
- Separating conversations with tcp.stream
- Reading and saving a conversation with Follow TCP Stream
- Decoding HTTP with Follow HTTP Stream
- Finding and reporting credentials sent unencrypted
- Reading FTP control and data connections
- Seeing session cookies exposed
- Reporting traffic findings
← Wireshark capture filters (BPF) · Wireshark fundamentals · Telling encrypted (TLS) from cleartext traffic with Wireshark →
Start for free