HTTP protocol incorrect sequence request

asked 2019-05-28 12:13:24 +0000

AmitZ gravatar image

updated 2019-05-28 13:48:39 +0000

Hello All,

I have PCAP file which contains several HTTP 1.1 GET request and response. Some of the requests are dived to 2 packet and so the responses for those requests. But although each request has 2 parts, the frame description display: [HTTP request 1/3] & [HTTP request 2/3] and there is never 3/3. In the response part also there are 2 parts,but the frame description display [HTTP response 2/3] & [HTTP response 3/3] and there isn't 1/3 in the response.

Why the request & response display out of 3 instead of out of 2.

Screen capture for example:


edit retag flag offensive close merge delete


Can you share the capture? You can post it on a public file share, e.g. Google Drive, DropBox etc. and post a link to the file here.

grahamb gravatar imagegrahamb ( 2019-05-28 12:32:03 +0000 )edit

Link to picture capturing:

AmitZ gravatar imageAmitZ ( 2019-05-28 13:48:02 +0000 )edit

We can't work with pictures. We have a very nice tool which takes actual capture files, not pictures, and shows us the packets. It's called Wireshark, I guess you've heard of it.

Jaap gravatar imageJaap ( 2019-05-28 14:01:33 +0000 )edit

Sorry, unfortunately, I can't upload the file. it contain some private information.

AmitZ gravatar imageAmitZ ( 2019-05-28 14:09:30 +0000 )edit

Then you can use tools like TraceWrangler to obfuscate that info, while leaving the relevant stuff intact.

Jaap gravatar imageJaap ( 2019-05-28 17:47:09 +0000 )edit