Wireshark HTTP Process

I 've been studying the Lighttpd source code. By the way, let's take a look at network programming. Let's get started.

 

Step 1 Set Wireshark filtering rules

TCP. Port EQ 81, and then start capturing

Step 2: http: // 183.61.16.168: 81/open the browser to access this address

Step 3: Analyze Data

 

2636 17.482576000 183.27.235.172 183.61.16.168 TCP 74 4197> hosts2-ns [SYN] seq = 0 win = 8192 Len = 0 mss = 1440 Ws = 4 sack_perm = 1

2638 17.498859000 183.61.16.168 183.27.235.172 TCP 74 hosts2-ns> 4197 [SYN, ack] seq = 0 ACK = 1 win = 14600 Len = 0 mss = 1460 sack_perm = 1 Ws = 512

2639 17.498994000 183.27.235.172 183.61.16.168 TCP 62 4197> hosts2-ns [ack] seq = 1 ACK = 1 win = 66240 Len = 0

 

The above is the TCP three-way handshake,

2696 18.028389000 183.27.235.172 183.61.16.168 TCP 463 4197> hosts2-ns [Psh, ack] seq = 1 ACK = 1 win = 66240 Len = 401

This is the HTTP request packet.

Length: 401

2698 18.051721000 183.61.16.168 183.27.235.172 TCP 62 hosts2-ns> 4197 [ack] seq = 1 ACK = 402 win = 15872 Len = 0

This is the data that the server returns to the browser. The server says that it has received the request and then returns ack with 401 or 402 to the client. If not, the browser resends the request to the server.

2699 18.052968000 183.61.16.168 183.27.235.172 TCP 289 hosts2-ns> 4197 [Psh, ack] seq = 1 ACK = 402 win = 15872 Len = 227

At this point, the server returns the homepage to the browser. The length is 227. Only data is available, and Len must be greater than 0.

2721 18.234494000 183.27.235.172 183.61.16.168 TCP 403 4197> hosts2-ns [Psh, ack] seq = 402 ACK = 228 win = 66012 Len = 341

The browser secretly initiates the second request, get/favicon. ICO,

2722 18.259705000 183.61.16.168 183.27.235.172 TCP 541 hosts2-ns> 4197 [Psh, ack] seq = 228 ACK = 743 win = 16896 Len = 479

The server says it does not have this file and then returns it to the client

 

2728 18.514549000 183.61.16.168 183.27.235.172 TCP 541 [TCP retransmission] hosts2-ns> 4197 [Psh, ack] seq = 228 ACK = 743 win = 16896 Len = 479

Resend again

 

2729 18.514663000 183.27.235.172 183.61.16.168 TCP 74 4197> hosts2-ns [ack] seq = 743 ACK = 707 win = 65532 Len = 0 = 228 SRE = 707

The browser said it was received and gave the server an answer.

3180 23.263527000 183.61.16.168 183.27.235.172 TCP 62 hosts2-ns> 4197 [Fin, ack] seq = 707 ACK = 743 win = 16896 Len = 0

The server closes the connection and sends a fin

3181 23.263637000 183.27.235.172 183.61.16.168 TCP 62 4197> hosts2-ns [ack] seq = 743 ACK = 708 win = 65532 Len = 0

The browser said it was received.

3587 27.508143000 183.27.235.172 183.61.16.168 TCP 62 4197> hosts2-ns [Fin, ack] seq = 743 ACK = 708 win = 65532 Len = 0

Then the browser sends a fin

3590 27.523692000 183.61.16.168 183.27.235.172 TCP 62 hosts2-ns> 4197 [ack] seq = 708 ACK = 744 win = 16896 Len = 0

Then the server says it received

 

In fact, there is a problem: seq and ACK are a little messy. Add this at the moment and add that at the moment.

 

Wireshark HTTP Process