HTTP protocol incorrect sequence request

  • retag add tags

Hello All,

I have PCAP file which contains several HTTP 1.1 GET request and response. Some of the requests are dived to 2 packet and so the responses for those requests. But although each request has 2 parts, the frame description display: [HTTP request 1/3] & [HTTP request 2/3] and there is never 3/3. In the response part also there are 2 parts,but the frame description display [HTTP response 2/3] & [HTTP response 3/3] and there isn't 1/3 in the response.

Why the request & response display out of 3 instead of out of 2.

Screen capture for example: https://www.dropbox.com/sh/w9563j98s6...

Thanks

AmitZ's avatar
1
AmitZ
asked 2019-05-28 12:13:24 +0000, updated 2019-05-28 13:48:39 +0000
edit flag offensive 0 remove flag close merge delete

Comments

Can you share the capture? You can post it on a public file share, e.g. Google Drive, DropBox etc. and post a link to the file here.

grahamb's avatar grahamb (2019-05-28 12:32:03 +0000) edit

Link to picture capturing: https://www.dropbox.com/sh/w9563j98s6...

AmitZ's avatar AmitZ (2019-05-28 13:48:02 +0000) edit

We can't work with pictures. We have a very nice tool which takes actual capture files, not pictures, and shows us the packets. It's called Wireshark, I guess you've heard of it.

Jaap's avatar Jaap (2019-05-28 14:01:33 +0000) edit

Sorry, unfortunately, I can't upload the file. it contain some private information.

AmitZ's avatar AmitZ (2019-05-28 14:09:30 +0000) edit

Then you can use tools like TraceWrangler to obfuscate that info, while leaving the relevant stuff intact.

Jaap's avatar Jaap (2019-05-28 17:47:09 +0000) edit
add a comment see more comments