[Andrej van der Zee <andrejvanderzee@xxxxxxxxx>]

Hi,

> Hi Andrej,
>
> Yep:)
>
> To see the different streams:
> $ tshark -r test.pcap -q -z conv,tcp

Thank you so much again! This is great.

What does "conversation" actually mean? Is this all the data that is
transmitted back and forth for the duration of the connection? I mean,
what event makes the conversation actually start and when does it end,
provided that the capture file contains the whole conversation?

Thank you,
Andrej