I am capturing a pop3 netcat connection (port 110) using Wireshark, on Debian linux (Kali). After filtering packets with (tcp.port eq 110) I get few packets but once I R.Click on any and click "Follow TCP Stream" I get empty window!

My question, is this a bug? (I found some ppl reporting it as a bug) or is this possible based on some conditions??

I tried to run Wireshark to analyze the pcap file, with root user and with limited user and the result is the same.

On some other packets I still can get contents on the TCP Stream window though.

1 Answer 1


Sure, it could be a bug. Alternatively, if no packets containing data (all packets are empty) are included in the TCP stream, you'll also get an empty window.

  • Even if you get an empty data window, you should be able to see the packets associated with the stream in the main window. Sep 14, 2014 at 11:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.