HTTP flow analysis and the Follow TCP Stream window

The Follow TCP Stream feature that was discussed in brief earlier in the book is a very helpful feature that can help you with in-depth understanding of the TCP flows that are captured when you monitor the network. In this recipe, we will see some of its advantages.

Getting ready

Port mirror the device or link you want to monitor and start packet capture.

How to do it...

1. For opening the Follow TCP Stream window, perform the following steps:

2. Right-click on one of the packets in the stream you want to view.

3. The stream you choose is filtered by the Wireshark. You will see this in the display filter bar that will show you the number of stream in the capture. You will get the following window:

   

4. You can see the stream details, for example:

   • The GET method (marked as 1 in the preceding screenshot)

   • The requested HOST (marked as 2 in the preceding screenshot)

   • The client type, Mozilla Firefox in this case, (marked as 3 in the preceding screenshot)

   • The referrer...