Overview
Individual packets are pieces of a larger conversation. Following a TCP stream reassembles those pieces into the actual back-and-forth exchange between two endpoints, making traffic far easier to understand. This lesson explains stream reassembly and its value.
Learning objectives
- Explain what a TCP stream is and why reassembly helps.
- Describe how a stream is followed in analysis.
- Recognize what stream analysis can reveal.
Core concept
A TCP stream is the complete sequence of data exchanged over one TCP connection, split across many packets in the capture. Because TCP numbers its bytes, an analysis tool can reassemble them in order and present the conversation as a continuous exchange rather than scattered packets. Wireshark's "Follow TCP Stream" does exactly this: it stitches one connection's segments into the readable dialogue between client and server.
How it works
The tool identifies all packets belonging to a single connection (same pair of IP:port sockets) and orders them by sequence number, separating each direction (client→server and server→response). The result is the actual payload as the application saw it — for an unencrypted protocol, this is human-readable. Following a stream also filters out everything else, letting you focus on just that one conversation from start (handshake) to finish (teardown).
Practical example
Following the TCP stream of an HTTP connection shows the full exchange in order: the client's GET /page HTTP/1.1 request with its headers, then the server's 200 OK response with headers and the HTML body — reconstructed exactly as sent. Instead of hopping between dozens of packets, you read the request and response as a clear dialogue, immediately seeing what was asked and answered.
Cybersecurity relevance
Stream reassembly is invaluable for investigation. For unencrypted traffic it can reveal transmitted credentials, commands, or exfiltrated data in plain view — showing exactly why sensitive traffic must be encrypted. Analysts follow streams to understand an attacker's actions over a connection, to extract indicators, or to confirm what data left the network. For encrypted streams (TLS) the payload is unreadable, which is precisely the protection TLS provides — reinforcing the value of encryption.
Common mistakes
- Analyzing packets in isolation when following the stream would make the conversation obvious.
- Expecting readable content from encrypted streams — TLS payloads are (correctly) opaque.
- Forgetting each direction of the conversation matters (request vs response).
Key takeaways
- A TCP stream is one connection's full data exchange, reassembled in order from many packets.
- "Following the stream" reconstructs the client/server dialogue, making unencrypted exchanges directly readable.
- Stream analysis reveals credentials, commands, or exfiltration in plaintext traffic — showing why encryption matters — while encrypted streams stay opaque by design.
Check your understanding
- What does "following a TCP stream" do that examining individual packets does not?
- Why can stream analysis expose credentials in HTTP traffic but not in HTTPS traffic?