2
1
I am sniffing the in/out packets over TCP. I have some GET output, but I want to know which of the packets is the input? How does the browser determine this?
Simpler explaination: I'm sniffing and I get all GET requests, but I'm not sure how to connect them with the HTTP 200 OK ones.
blez
Posted 2013-03-11T17:39:14.530
Reputation: 209
3
To a better understanding, take a look on the entire Http article on wikipedia, but above you can see that the "handle" to the GET is coordinated by the transport layer(TCP):
An HTTP session is a sequence of network request-response transactions. An HTTP client initiates a request by establishing a Transmission Control Protocol (TCP) connection to a particular port on a server (typically port 80; see List of TCP and UDP port numbers). An HTTP server listening on that port waits for a client's request message. Upon receiving the request, the server sends back a status line, such as "HTTP/1.1 200 OK", and a message of its own. The body of this message is typically the requested resource, although an error message or other information may also be returned.
Diogo
Posted 2013-03-11T17:39:14.530
Reputation: 28 202
The thing is that I have 2 streams - input and output. I have to know which HTTP OK packet is the response to each GET packet, but I don't know how. – blez – 2013-03-11T17:57:18.163
2
the ordering you want occures below the HTTP layer at the TCP layer, so the sequencing is handled by the ACK and SYN values in the packets. see here for how those values get initialized and incremented with each packet in the flow: http://en.wikipedia.org/wiki/SYN_%28TCP%29#Connection_establishment . also remember, there may not be a 1-to-1 relation between packets and requests/responses, though it is likely that most requests are sent in a single packet.
– Frank Thomas – 2013-03-11T18:15:10.473