Skip to main content

Follow TCP Streams on macOS

A packet list shows when data crossed the network. Follow TCP Stream shows what one TCP connection exchanged. TCP Viewer reassembles the selected conversation with its bundled Wireshark engine and presents both directions in a focused Mac-native window.

Follow TCP Stream in TCP Viewer with direction, text, hex, and search controls

Read a reassembled TCP conversation in Text or Hex, isolate either direction, and search without losing the source packets.

1. The problem​

An application message rarely fits neatly into one captured packet. Its bytes may be split across many packets, arrive out of order, be retransmitted, or be completed by a later fragment. Reading each packet separately makes it hard to answer a basic question: what did the client and server actually exchange?

Follow TCP Stream rebuilds the payload into conversation order. It gives you a continuous view while preserving packet numbers and direction labels, so you can move between the conversation and the evidence that produced it.

2. Why use Follow TCP Stream​

The workflow is familiar to Wireshark users, with controls designed for a native TCP Viewer workspace.

  • ✅ Understand a full request-and-response sequence instead of scanning isolated payloads.
  • ✅ Distinguish Client → Server from Server → Client at every turn.
  • ✅ Show both directions together or isolate one side of the exchange.
  • ✅ Switch between readable Text and exact Hex bytes.
  • ✅ Search the transcript with a match count and previous/next navigation.
  • ✅ Return to a source packet and its matching bytes without losing the stream.
  • ✅ Save the readable transcript or export either direction as raw bytes.

3. How to use Follow TCP Stream​

  1. Start a live packet capture or open a capture file.
  2. Select one TCP packet in the packet table.
  3. Right-click the row and choose Follow TCP Stream.
  4. Wait while TCP Viewer prepares the packet snapshot and reassembles the selected connection.
  5. Read the stream in the separate Follow TCP Stream window while continuing to use the main capture window.

The command is unavailable when the selection contains multiple packets or the selected row is not TCP. A Follow window represents a snapshot of the capture. For a live connection that receives more data later, open the stream again to create a newer snapshot.

4. Choose a direction and representation​

Use the controls above the transcript:

  • Both keeps the complete back-and-forth conversation together.
  • Client → Server shows only bytes sent by the client.
  • Server → Client shows only bytes returned by the server.
  • Text displays printable content and replacement characters for binary data.
  • Hex displays offsets, exact byte values, and an ASCII preview.
  • The Stream stepper moves to the previous or next TCP stream available in the same capture.

Direction remains visible in the transcript labels, not by color alone. Packet numbers and byte counts help you understand where each turn came from.

5. Search and return to a packet​

Press Command-F to focus Search transcript, then type the text or hex sequence you need. TCP Viewer shows the current match and total count. Use the up and down buttons to move between matches; navigation wraps at either end.

To inspect the capture behind a transcript record:

  1. Move the pointer over its Client to Server or Server to Client label.
  2. Click Show Packet.
  3. TCP Viewer selects the corresponding packet in the main table, scrolls it into view, and opens the matching byte source in the inspector.

A reassembled record can contain bytes contributed by more than one captured frame. In that case, the complete Follow record may not match the raw Frame bytes of a single row. Use the reassembled byte selection in packet inspection to understand the relationship.

6. Save a transcript or raw bytes​

Open the Save menu in the Follow window:

  • Save Transcript… writes the currently rendered readable transcript.
  • Export Client Bytes… writes the raw Client → Server payload.
  • Export Server Bytes… writes the raw Server → Client payload.

Stream payloads can contain credentials, cookies, tokens, private host names, or application data. Review exported files before sharing them. See Save, copy, and export for capture-level export options.

7. Understand encrypted and partial streams​

Follow TCP Stream reassembles captured bytes; it does not decrypt TLS. For an HTTPS or another encrypted connection, Text may look unreadable while Hex still shows the exact ciphertext that crossed the network.

A stream can also be partial when the capture started mid-connection, ended early, dropped packets, or reached a safety limit. Check the status below the endpoints before assuming the transcript contains the complete exchange.

Use packet filters to find the connection first, and use packet inspection when you need decoded protocol fields for one specific packet.