For example, I want to see all the http requests containing the given string in the http.host field and their respective responses. Right now my filter is frame.number < 61403 and http.host contains tdc1. But it omits the responses and I have no idea how to add them.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Nov 19, 2022 at 23:04
  • Unfortunately, no. The answer was not satisfying. And I have no way of knowing if there is a better answer without delving deep into it myself. Which I do not have the time now.
    – mark
    Nov 20, 2022 at 16:10

2 Answers 2


A somewhat practical method is to

  1. select one of the packets in question
  2. expand Transmission Control Protocol
  3. look for the [Stream index: n] metatag
  4. change or expand your filter to/with tcp.stream eq n

Alternatively, you can just right-click the packet and select Follow → TCP Stream or hit Ctrl-Shift-Alt-T - this overwrites your current filter though.


You may have to filter on the requests and responses separately, then merge the pcap files.

  • Ouch. Is by "merging" you mean simple concat?
    – mark
    Apr 15, 2022 at 21:41
  • Wireshark can merge files.
    – Ron Trunk
    Apr 15, 2022 at 22:50
  • How can I filter responses matching the filters? E.g. I can filter requests by the http.host field. But how can I get the respective responses?
    – mark
    Apr 16, 2022 at 4:44
  • What exactly are you trying to do? What data are you looking for?
    – Ron Trunk
    Apr 16, 2022 at 13:21
  • I have captured HTTP traffic outgoing from my build agent. Some traffic goes to the Azure DevOps Server, some goes to other machines - has to do with the fact that the build agent is in Azure. I want to concentrate only on the traffic to the Azure DevOps Server - inspect the requests and their corresponding responses. I may further reduce the amount of "interesting" requests and would like to see their matching responses.
    – mark
    Apr 16, 2022 at 14:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.