On 06/13/14 10:59, Perry Smith wrote:
When I "Follow TCP Conversation", I get another window with the text of the conversation which I don't need. I just want to set the filter. One reason is it takes a long time to create the window sometimes. Is there a way to do that?
So you just want to get the "tcp.stream eq X" filter (where you don't
know the value of X), right?
To do that without using the "Follow" UI, just:
1) Open the TCP section in the packet-decode (middle) pane of the packet
you're interested in
2) Find the item that says "[Stream index: X]"
3) Right-click and select "Apply as filter"
(I think the decode item mentioned in (2) may not be present in older
versions of Wireshark; if you don't see it, try upgrading.)