2

After visiting a simple webpage at my browser, how can I check how many data containing TCP segments carried the HTTP response and the text file, in Wireshark?

When I check the Packet List window I find x TCP segments, but if I check the Packet Details window for the "HTTP 200 OK" response it says that there were x+1 Reassembled TCP segments. This extra TCP segment is the "HTTP 200 OK" response. Do we have to count this packet as well?

Improve this question

1 Answer 1

Reset to default
1

When I check the Packet List window I find x TCP segments

Do you mean "I find x rows that say "[TCP segment of reassembled PDU]"?

but if I check the Packet Details window for the "HTTP 200 OK" response it says that there were x+1 Reassembled TCP segments. This extra TCP segment is the "HTTP 200 OK" response. Do we have to count this packet as well?

If you mean "do I have to count more than the segments whose Info column just says "[TCP segment of reassembled PDU]", the answer is "yes" - when the last segment is seen, the HTTP request or response is dissected, and information about that request or response is put into the Info column.

Don't assume the only segments in a request or response are the ones labeled as "[TCP segment of reassembled PDU]".

Improve this answer
1
  • Yes, I meant exactly what you said. Thank you very much for the response, it was really detailed and helpful! :)
    – ntina.ve
    Nov 20, 2015 at 2:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.