streams with tshark

Wiresharks command-line complement, tshark, is pretty handy in a jam. You can even extract stream numbers:

$ tshark -r dump.pcap -T fields -e tcp.stream

Using the stream numbers, you can be much more precise in your filters:

$ tshark -r dump.pcap -T fields -e text tcp.stream eq $stream