Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I use Wireshark on Linux to observe my HTTP traffic. Other programms like Firefox Live Http Headers show coupled http-request from my browser and http-respond from any server.

How using programs like Wireshark understand that one is request and another is respond to certain request? Is there a methodology which I can use for any traffic manager program?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Wireshark's "follow TCP stream" feature shows the data payload that flows in both directions on the selected socket connection. So it matches up packets by socket connection, which is the combination of Host1_IP_address:port <-> Host2_IP_address:port.

You can read more on wireshark's web page at http://www.wireshark.org/docs/wsug_html_chunked/ChAdvFollowTCPSection.html

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.