I use Wireshark on Linux to observe my HTTP traffic. Other programms like Firefox Live Http Headers show coupled http-request from my browser and http-respond from any server.

How using programs like Wireshark understand that one is request and another is respond to certain request? Is there a methodology which I can use for any traffic manager program?

2 Answers 2


Wireshark's "follow TCP stream" feature shows the data payload that flows in both directions on the selected socket connection. So it matches up packets by socket connection, which is the combination of Host1_IP_address:port <-> Host2_IP_address:port.

You can read more on wireshark's web page at http://www.wireshark.org/docs/wsug_html_chunked/ChAdvFollowTCPSection.html


Use "follow TCP stream" if you want but that's not always most convenient because it changes the display filter you were using and another window pops up.

The easiest method is to unfold the HTTP dissector section in the packet details window. If the packet is not corrupted you'll find a link there. Either "Response in frame: NUMBER" or "Request in frame: NUMBER" like on the screenshots below. Just double click it to jump to the corresponding request or response or choose the "go to corresponding packet" from the context menu.

Shameless plug: I teach that in details in my udemy course on wireshark

http dissector response link

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .