ScottOrzechowski

Merging packet captures from both ends of a socket

Blog Post created by ScottOrzechowski Employee on Dec 15, 2015

Maybe you already use this, but I just realized you can merge packet captures that occurred simultaneously into one view in Wireshark.  This is useful when troubleshooting connectivity, security or firewall issues, when you want to see whether some packets didn't arrive at their destination, or you want to see a TCP stream in the context of communication with other machines (like proxies, other servers, etc.).  Load one pcap, and go to File -> Merge.  Choose the pcap from the other machine.  Wireshark will highlight packets based on which file they came from.

 

Outcomes