There will be occasions when you would like to see the data from a TCP session in the order that the application layer sees it. Perhaps you are looking for passwords in a Telnet stream, or you are trying to make sense of a data stream. If so, Ethereal's ability to follow a TCP stream will be useful to you.
Simply select a TCP packet in the stream/connection you are interested in and then select the Follow TCP Stream menu item from the Ethereal Tools menu. Ethereal will pop up a separate window with all the data from the TCP stream laid out in order, as shown in Figure 7.1, “The "Follow TCP Stream" dialog box”.
You can choose from the following actions:
Save As Save the stream data in the currently selected format.
Print Print the stream data in the currently selected format.
Direction Choose the stream direction to be displayed ("Entire conversation", "data from A to B only" or "data from B to A only").
Filter out this stream Apply a display filter removing the current TCP stream data from the display.
Close Close this dialog box.
You can then choose to view the data in one of the following formats:
ASCII. In this view you see the data from each end in ASCII, but alternating according to when each end sent data. Unfortunately, non-printing characters do not print.
EBCDIC. For the big-iron freaks out there.
HEX Dump. This allows you to see all the data, but you lose the ability to read it in ASCII.
C Arrays. This allows you to import the stream data into your own C program.
Raw. This allows you to load the unaltered stream data into a different program for further examination.
![]() | Note! |
---|---|
It is worthwhile noting that Follow TCP Stream installs a filter to select all the packets in the TCP stream you have selected. |