I am capturing a pop3 netcat connection (port 110) using Wireshark, on Debian linux (Kali). After filtering packets with (tcp.port eq 110) I get few packets but once I R.Click on any and click "Follow TCP Stream" I get empty window!

My question, is this a bug? (I found some ppl reporting it as a bug) or is this possible based on some conditions??

I tried to run Wireshark to analyze the pcap file, with root user and with limited user and the result is the same.

On some other packets I still can get contents on the TCP Stream window though.

1 Answer 1


Sure, it could be a bug. Alternatively, if no packets containing data (all packets are empty) are included in the TCP stream, you'll also get an empty window.

  • Even if you get an empty data window, you should be able to see the packets associated with the stream in the main window. Sep 14, 2014 at 11:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .