Wireshark mailing list archives
invisible http responses and multiple http responses
From: esolve esolve <esolvepolito () gmail com>
Date: Thu, 18 Oct 2012 23:26:52 +0200
Hi, I used tcpdump to capture youtube packets, then I read those captured pcap file with wireshark I noticed that some http responses (like http 200 OK) are invisible in the wireshark and they are inside the TCP segment of an reasembled PDU. I read the TCP data palyload and noticed them. These segments are following directly after the corresponding http request. I also tried to identify them through tcpshark but failed. So are there any ways to identify these invisible http responses? Besides, when I follow a tcp stream for a http request-response, I noticed near the end of the stream, there is usually a http 200 OK response. Since there is already a http 200 OK response as mentioned above, what is the http 200 ok near the end of the stream? I tried to find the corresponding HTTP request by looking at the the nearby packets that are before this http 200 OK packet but I can't find one. Does this mean there are multiple http responses?
___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- invisible http responses and multiple http responses esolve esolve (Oct 18)