How can you use the Conversations view to analyze a single TCP session?

• A. Right-click on a packet and select Follow TCP Stream.
• B. Statistics > Conversations > TCP to inspect per-session metrics such as source/destination and bytes exchanged.
• C. Statistics > Endpoints.
• D. Analyze > Flow Graph.

Answer: (B)

Conversations view summarizes activity per TCP session, letting you see who talked to whom and how much data was exchanged in that session. Access it via Statistics > Conversations > TCP, where each row represents a single TCP connection and shows fields like Local Address, Remote Address, Packets, Bytes, and Throughput.

This is the best way to analyze a single TCP session because it provides a concise, per-session summary of the exchange between two endpoints, making it easy to quantify data transfer and identify the specific connection of interest. In contrast, following a TCP stream focuses on the content of one stream’s payload, Endpoints lists totals by host rather than per-session conversations, and Flow Graph presents a visual flow of activity rather than per-session metrics.