HTTP flow analysis

The follow TCP stream feature, discussed in brief earlier in the book, is a very helpful feature that can help you with an in-depth understanding of the TCP flows that are captured when you monitor the network. In this recipe, we will see some of its advantages.

Getting ready

Port-mirror the device or link you want to monitor and start packet capture.

How to do it...

To open the Follow TCP Stream window, perform the following steps:

1. Right-click on one of the packets in the stream you want to view.
2. The stream you choose is filtered by the Wireshark. You will see this in the display filter bar that will show you the number of stream in the capture. You will see the following window:

Figure 12.14: Follow TCP stream

3. You can see the stream details, for example:
   • The GET method (marked as 1 in the preceding screenshot)
   • The requested HOST(marked as 2 in the preceding screenshot)
   • The client type, Mozilla Firefox in this case (marked as 3 in the preceding screenshot)
   • The referrer, Cisco in...