Follow Stream

The Follow Stream feature in CloudShark allows you to view reassembled TCP and UDP streams when analyzing packet captures.

When examining a packet that is part of a conversation, you can view the complete stream data in the different tabs of the packet bytes pane. This provides an easy way to see the full conversation between two endpoints.

The two sides of the conversation are highlighted in blue and red for easy differentiation. Clicking any part of the conversation will select the corresponding packet in the packet list.

Follow Stream also supports special handling for these protocols:

• HTTP traffic is automatically decompressed to show the uncompressed content.

• Encrypted TLS traffic can be decrypted when the appropriate decryption profile is configured.