Re: invalid request

[Guy Harris <guy () alum mit edu>]

On Mar 13, 2012, at 11:57 AM, mustafa alhussona wrote:

> i installed squid server and i have invalid request, so i decided to check the traffic using the wireshark, please 
> can you tell me what does this line mean 
>
> [protocols in frame: eth:ip:tcp:http:data]

It means that the packet is an Ethernet packet, containing an IP packet, containing a TCP segment, containing part or 
all of an HTTP request or response, and the body of the HTTP request or response is something Wireshark can't dissect, 
so it just shows it as data.

> please what is the meaning of data ok i know the ip:tcp:http is for http request, but what data protocol mean 

It means that Wireshark doesn't know what the contents of the HTTP request are, because it either doesn't know what the 
content type is or because it doesn't know how to interpret that particular content type, so it just shows it as data.

> and there is a new field describes this data the field called Hypertext Transfer Protocol and contain data of length 
> 56 byte 

Yes, HTTP stands for HyperText Transfer Protocol; the 56 bytes are probably the HTTP request line and message headers.

> why this request is considered invalid request 

We'd have to see the request in order to know why it's considered invalid.

If your Wireshark capture also includes the response, the response might indicate why the request is considered invalid.

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe