 | 1 | initial version |
That's because HTTP tells the content length in the 200 OK header before the content starts. Look in there and you'll see "Content-Length: xxx bytes", matching the number of bytes to follow. So Wireshark can track if that number of bytes were transferred and knows when to stop reassembly.
The same happens for all other protocols on TCP - they need to have some kind of length value that tells the receiver how long the content is.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
