Wireshark - How to see both sides of a tcp conversation?

I'm trying to create a filter on a capture file that shows me both sides of the tcp conversation between my laptop and a server.

I thought that tcp.srcport == xxxxxx would do it.  I've done this before, but at the moment, how I've done it escapes me.  I want to see something like

laptop ip.src xxx  server ip.dst xxx syn
server ip.src xxx  laptop ip.dst xxx syn-ack
laptop ip.src xxx server ip.dst xxx ack

tcp.srcport == xxx is displaying
laptop ip.src xxx  server ip.dst xxx syn
laptop ip.src xxx server ip.dst xxx ack

Who can help me out with creating the filter here?

Thanks
WestezAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

WestezAuthor Commented:
I've got it, it's tcp.port == xxxxxx

Who can show me another way?
0
bcbigbCommented:
Worry about the TCP flags after you get the initial conversation filtered.

Start with something like:

"ip.addr eq 192.168.5.1 and ip.addr eq 192.168.5.100"

...which can be easily generated by selecting a packet between the desired source/dest addresses, right-clicking and selecting "Conversation Filter" --> "IP"


Then you can append whatever other filter characteristics you want, such as SYNs only:

" && (tcp.flags.syn == 1)"

or ACKs only:

" && (tcp.flags.ack == 1)"

(note, remember to be careful about ANDs vs ORs... if you applied one or the other of the above, you will keep SYN/ACKs.  If you appended *both* of the above you would *only* get SYN/ACK packets, and not one or the other)

to do one or the other, append the following to the above:

" && ((tcp.flags.syn == 1) || (tcp.flags.ack == 1))"


Hopefully this answers your question...

If you're getting too many packets and are sure you only want this conversation, you can write a capture filter to keep only this TCP conversation in Wireshark...

~BC
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
bcbigbCommented:
tcp.port will only filter packets with a certain source or dest. port #, which will not filter either the conversation only nor will it filter acks or syns or any other packets with specific flags.
0
Cloud Class® Course: Ruby Fundamentals

This course will introduce you to Ruby, as well as teach you about classes, methods, variables, data structures, loops, enumerable methods, and finishing touches.

bcbigbCommented:
The first filter is all you're looking for if you want just the conversation between the computers. If you want filters to do other things or filter more specifically let me know.
0
Rick_O_ShayCommented:
The syntax for a tcp connection is:
ip.addr==11.10.16.6 && tcp.port==51415 && ip.addr==11.10.24.11 && tcp.port==113

An easy way to filter it is go to statistics then conversations and click the TCP tab {if it is TCP}.
Right click the session in there and apply as filter/selected/A to B.
0
WestezAuthor Commented:
Hey thanks a bunch guys.  I appreciate your cluing me in to some of the finer details.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Network Analysis

From novice to tech pro — start learning today.