Following TCP streams
There will be occasions when you would like to see the data on a TCP session in the order that the application layer would see it. Perhaps you are looking for passwords in a Telnet stream, or perhaps you are trying to make sense of a data stream. If so, Ethereal's ability to follow a TCP stream will be useful to you.
Simply select a TCP segment on the stream/connection you are interested in and then select the Follow TCP Stream menu item from the Ethereal Tools menu. Ethereal will pop up a separate window with all the data from the TCP stream layed out in order, as shown in Figure 3-23.
You can then select to view the data in one of three formats:
ASCII. In this view you see the data from each end in ASCII, but alternating according to when each end sent data. Unfortunately, non-printing characters do not print.
EBCDIC. For the big-iron freaks out there.
HEX Dump. This allows you to see all the data, but you lose the ability to read it in ASCII.
Note: Note!
It is worthwhile noting that Follow TCP Stream installs a filter to select all the packets on the TCP stream you have selected.