Glossary
5-tuple
A 5-tuple identifies a network flow by protocol, source address, source port, destination address and destination port. It is the key of a conversation.
A 5-tuple is the set of five values that identifies a network flow: transport protocol (TCP or UDP), source IP address, source port, destination IP address and destination port. All packets sharing the same 5-tuple, in either direction, belong to the same conversation, which is how capture tools group packets into flows and count bytes per direction.
In triage, the 5-tuple is the unit you pivot on: from a DNS answer to the connection that followed, from a conversation to its HTTP requests or TLS handshake. Ports are reused over time, so tools also use timestamps and TCP handshakes to separate successive flows with the same 5-tuple. The Conversations view in PCAP Parser lists one row per 5-tuple; see how to use PCAP Parser.