Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I use Wireshark on Linux to observe my HTTP traffic. Other programms like Firefox Live Http Headers show coupled http-request from my browser and http-respond from any server.

How using programs like Wireshark understand that one is request and another is respond to certain request? Is there a methodology which I can use for any traffic manager program?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Wireshark's "follow TCP stream" feature shows the data payload that flows in both directions on the selected socket connection. So it matches up packets by socket connection, which is the combination of Host1_IP_address:port <-> Host2_IP_address:port.

You can read more on wireshark's web page at http://www.wireshark.org/docs/wsug_html_chunked/ChAdvFollowTCPSection.html

share|improve this answer

Use "follow TCP stream" if you want but that's not always most convenient because it changes the display filter you were using and another window pops up.

The easiest method is to unfold the HTTP dissector section in the packet details window. If the packet is not corrupted you'll find a link there. Either "Response in frame: NUMBER" or "Request in frame: NUMBER" like on the screenshots below. Just double click it to jump to the corresponding request or response or choose the "go to corresponding packet" from the context menu.

Shameless plug: I teach that in details in my udemy course on wireshark

http dissector response link

enter image description here

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.