Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
I use Wireshark on Linux to observe my HTTP traffic. Other programms like Firefox Live Http Headers show coupled http-request from my browser and http-respond from any server.
How using programs like Wireshark understand that one is request and another is respond to certain request? Is there a methodology which I can use for any traffic manager program?
Wireshark's "follow TCP stream" feature shows the data payload that flows in both directions on the selected socket connection. So it matches up packets by socket connection, which is the combination of Host1_IP_address:port <-> Host2_IP_address:port.
You can read more on wireshark's web page at http://www.wireshark.org/docs/wsug_html_chunked/ChAdvFollowTCPSection.html
Use "follow TCP stream" if you want but that's not always most convenient because it changes the display filter you were using and another window pops up.
The easiest method is to unfold the HTTP dissector section in the packet details window. If the packet is not corrupted you'll find a link there. Either "Response in frame: NUMBER" or "Request in frame: NUMBER" like on the screenshots below. Just double click it to jump to the corresponding request or response or choose the "go to corresponding packet" from the context menu.
Shameless plug: I teach that in details in my udemy course on wireshark
