How do you reconstruct a complete HTTP conversation spanning multiple TCP segments in Wireshark?

• A. Use Reassemble TCP option
• B. Use Follow HTTP Stream to view the assembled HTTP request/response
• C. Enable Layered Reassembly
• D. Follow TCP Stream to view the assembled HTTP request/response for a single TCP stream

Answer: (D)

When a HTTP conversation spans several TCP segments, you reassemble the data at the TCP connection level. Following the TCP stream pulls together all segments that belong to that single connection, ordering them correctly and presenting the full payload as one continuous dialogue. This lets you see the entire HTTP request and its corresponding response in the exact sequence they were exchanged, even if they were split across many packets. While following HTTP Stream can show the HTTP content for that same connection, the TCP stream view is the primary, complete view of the conversation across all segments. The underlying reassembly options help Wireshark build contiguous data, but the direct, reliable way to reconstruct and view the whole exchange across multiple segments is to follow the TCP stream.