Revision history [back]

Hi,

How does wireshark knows when the file download is completed ?

After downloading a file, we see the usual "FIN - FIN/ACK - FIN/ACK - FIN" packets.

The packet just before have the last part of the data. In this case, a jpg file.

Below the TCP layer, wireshark kindly reassembles the TCP segments, i.e. "10 Reassembled TCP Segments ...".

And below that, we see the assembled HTTP and JPEG layers.

But my question is, what makes wireshark knows that this packet contains the last part of the jpg file ?

Hi,

How does wireshark knows when the file download is completed ?

After downloading a file, we see the usual "FIN - FIN/ACK - FIN/ACK - FIN" packets.

The packet just before have the last part of the data. In this case, a jpg file.

Below For that packet, below the TCP layer, wireshark kindly reassembles the TCP segments, i.e. "10 Reassembled TCP Segments ...".

And below that, the "10 Reassembled..." line, we see the assembled HTTP and JPEG layers.

But my question is, what makes wireshark knows that this packet contains the last part of the jpg file ?

Hi,

How does wireshark knows when the file download is completed ?

After downloading a file, we see the usual "FIN - FIN/ACK - FIN/ACK - FIN" packets.

The packet just before have the last part of the data. In this case, a jpg file.

For that packet, below the TCP layer, wireshark kindly reassembles the TCP segments, i.e. "10 Reassembled TCP Segments ...".

And below the "10 Reassembled..." line, we see the assembled HTTP and JPEG layers.

But my question is, what makes wireshark knows that this packet contains the last part of the jpg file ?