I tried to listen for ipv4 packets on the HTTP port 80, however I just got received HTTP string back - is this the right way to go about things? My understanding was that a TCP packet would be returned, containing HTTP.

  • 2
    If your going to capture packets, you need to listen at the data link layer or lower. In other words, one layer lower than what you're looking for. – Ron Trunk Mar 16 '17 at 15:10
  • 1
    HTTP is an application-layer protocol (above OSI layer-4), which is off-topic here. IPv4 packets are at OSI layer-3, which has TCP as the payload, and HTTP is the payload of TCP. By the time it gets to HTTP, the IP packet and TCP segment are gone. – Ron Maupin Mar 16 '17 at 17:21

When a client contact an htpp server on TCP port 80, this port is the destination port. The client use a random port with a number higher than 1024 as the source port When the server reply the source and destination (for both IP and ports) are reversed.

I.E. the request from the client to the server has those characteristics:

  • source IP adress: the client IP address
  • protocol : TCP
  • source port : a random port greater than 1024
  • destination IP address: the server IP address
  • destination port : 80

Then when the server reply, the reply has those characteristics:

  • source IP adress: the server IP address
  • protocol : TCP
  • source port : 80
  • destination IP address: the client IP address
  • destination port : the random port that was used in the request

So if you want to listen to the traffic you must filter on both answers and responses that have different destination IP and port.

Most packet sniffers (TCPDump , Wireshark...) can filter traffic on the IP on port without specifyin if it is source or destination.


tcpdump host and port 80

will match traffic in either direction.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.