This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Can’t find Socket ID.

0

Can't find Socket ID. How can I know that all packets are in the same socket.

asked 19 Apr '16, 00:49

AMitiev's gravatar image

AMitiev
6224
accept rate: 0%


One Answer:

0

A socket is the combination of the IP address and the port. So if you're looking for sockets, combine source IP and source port, as well as destination IP and destination port.

answered 19 Apr '16, 03:49

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

I wondered if the OP was asking about an actual socket instance for the client\server application.

If so, for TCP, each new socket will have to undertake the 3-way handshake, but in UDP for example, there's no clue in a capture file.

(19 Apr '16, 04:37) grahamb ♦