Analysis of an HTTP packet trace

Paste this command into your terminal:

The password to connect is

Question 1: A simple HTTP trace

Network engineers often need to capture the packets that are exchanged over a network to debug various types of problems. Here is a simple packet trace

Open this packet trace in wireshark or use tcpdump on the command line determine which of the affirmations below are correct.

The response returned by the server is 62 bytes long.

The client used to retrieve this object is Google Chrome

The response was served by the Apache server

The server returns a status code of 200 which indicates a success.

The client uses HTTP/1.0

The URL of the retrieved web object is http://nghttp2.org/robots.txt

The server returns a status code of 404 which indicates that the requested object could not be found.

The MIME Content-Type of the retrieved web object is text/html

Question 2: The HTTP trace

#	Length	Summary
0	20 bytes	`Transmission Control Protocol, Src Port: 44914, Dst Port: 80, Seq: 0, Len: 0`
1	20 bytes	`Transmission Control Protocol, Src Port: 80, Dst Port: 45118, Seq: 0, Ack: 1, Len: 0`
2	20 bytes	`Transmission Control Protocol, Src Port: 45118, Dst Port: 80, Seq: 1, Ack: 1, Len: 0`
3	117 bytes	`Hypertext Transfer Protocol`
4	20 bytes	`Transmission Control Protocol, Src Port: 80, Dst Port: 45118, Seq: 1, Ack: 86, Len: 0`
5	497 bytes	`Hypertext Transfer Protocol`
6	20 bytes	`Transmission Control Protocol, Src Port: 45118, Dst Port: 80, Seq: 86, Ack: 466, Len: 0`
7	20 bytes	`Transmission Control Protocol, Src Port: 80, Dst Port: 45118, Seq: 466, Ack: 86, Len: 0`
8	20 bytes	`Transmission Control Protocol, Src Port: 45118, Dst Port: 80, Seq: 86, Ack: 467, Len: 0`
9	20 bytes	`Transmission Control Protocol, Src Port: 80, Dst Port: 44914, Seq: 0, Ack: 1, Len: 0`
10	20 bytes	`Transmission Control Protocol, Src Port: 44914, Dst Port: 80, Seq: 1, Len: 0`
11	20 bytes	`Transmission Control Protocol, Src Port: 80, Dst Port: 45118, Seq: 467, Ack: 87, Len: 0`

0000 af72005014178133 00000000a0007210
0010 88c20000

0000 ¯r.P...3......r.
0010 .Â..

Transmission Control Protocol, Src Port: 44914, Dst Port: 80, Seq: 0, Len: 0
- Source Port: 44914
- Destination Port: 80
- TCP Segment Len: 0
- Sequence number: 0 (relative sequence number)
- Acknowledgment number: 0
- 1010 .... = Header Length: 40 bytes (10)
- Window size value: 29200
- Calculated window size: 29200
- Checksum: 0x88c2 [unverified]
- Urgent pointer: 0

0000 0050b03e63660de9 95fa02fda000fb04
0010 ad8b0000

0000 .P°>cf.é.ú.ý..û.
0010 ....

Transmission Control Protocol, Src Port: 80, Dst Port: 45118, Seq: 0, Ack: 1, Len: 0
- Source Port: 80
- Destination Port: 45118
- TCP Segment Len: 0
- Sequence number: 0 (relative sequence number)
- Acknowledgment number: 1 (relative ack number)
- 1010 .... = Header Length: 40 bytes (10)
- Window size value: 64260
- Calculated window size: 64260
- Checksum: 0xad8b [unverified]
- Urgent pointer: 0

0000 b03e005095fa02fd 63660dea800000e1
0010 d4b50000

0000 °>.P.ú.ýcf.ê...á
0010 Ôµ..

Transmission Control Protocol, Src Port: 45118, Dst Port: 80, Seq: 1, Ack: 1, Len: 0
- Source Port: 45118
- Destination Port: 80
- TCP Segment Len: 0
- Sequence number: 1 (relative sequence number)
- Acknowledgment number: 1 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 225
- Calculated window size: 225
- Window size scaling factor: -1 (unknown)
- Checksum: 0xd4b5 [unverified]
- Urgent pointer: 0

0000  b03e005095fa02fd  63660dea800000e1
0010  1190000000000000  0000000000000000
0020  474554202f726f62  6f74732e74787420
0030  485454502f312e30  0d0a486f73743a20
0040  6e6768747470322e  6f72670d0a557365
0050  722d4167656e743a  206375726c2f372e
0060  35382e300d0a4163  636570743a202a2f
0070  2a0d0a0d0a

0000  °>.P.ú.ýcf.ê...á
0010  ................
0020  GET /robots.txt
0030  HTTP/1.0..Host:
0040  nghttp2.org..Use
0050  r-Agent: curl/7.
0060  58.0..Accept: */
0070  *....

Transmission Control Protocol, Src Port: 45118, Dst Port: 80, Seq: 1, Ack: 1, Len: 85
- Source Port: 45118
- Destination Port: 80
- TCP Segment Len: 85
- Sequence number: 1 (relative sequence number)
- Acknowledgment number: 1 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 225
- Calculated window size: 225
- Window size scaling factor: -1 (unknown)
- Checksum: 0x1190 [unverified]
- Urgent pointer: 0
- TCP payload (85 bytes)
Hypertext Transfer Protocol
- GET /robots.txt HTTP/1.0\r\n
  - Request Method: GET
  - Request URI: /robots.txt
  - Request Version: HTTP/1.0
- Host: nghttp2.org\r\n
- User-Agent: curl/7.58.0\r\n
- Accept: */*\r\n
- \r\n

0000 0050b03e63660dea 95fa03528000007e
0010 d3d60000

0000 .P°>cf.ê.ú.R...~
0010 ÓÖ..

Transmission Control Protocol, Src Port: 80, Dst Port: 45118, Seq: 1, Ack: 86, Len: 0
- Source Port: 80
- Destination Port: 45118
- TCP Segment Len: 0
- Sequence number: 1 (relative sequence number)
- Acknowledgment number: 86 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 126
- Calculated window size: 64512
- Window size scaling factor: 512
- Checksum: 0xd3d6 [unverified]
- Urgent pointer: 0

0000  0050b03e63660dea  95fa03528000007e
0010  505e000000000000  0000000000000000
0020  485454502f312e30  20323030204f4b0d
0030  0a446174653a2053  61742c203236204f
0040  6374203230313920  32313a30373a3332
0050  20474d540d0a436f  6e74656e742d5479
0060  70653a2074657874  2f706c61696e0d0a
0070  4c6173742d4d6f64  69666965643a204d
0080  6f6e2c2031392041  7567203230313920
0090  31333a32303a3336  20474d540d0a4574
00A0  61673a2022356435  61613232342d3365
00B0  220d0a4163636570  742d52616e676573
00C0  3a2062797465730d  0a436f6e74656e74
00D0  2d4c656e6774683a  2036320d0a582d42
00E0  61636b656e642d48  65616465722d5274
00F0  743a20302e303031  3331350d0a436f6e
0100  6e656374696f6e3a  20636c6f73650d0a
0110  5365727665723a20  6e6768747470780d
0120  0a5669613a203220  6e6768747470780d
0130  0a616c742d737663  3a2068332d32333d
0140  223a34343333223b  206d613d33363030
0150  0d0a782d6672616d  652d6f7074696f6e
0160  733a2053414d454f  524947494e0d0a78
0170  2d7873732d70726f  74656374696f6e3a
0180  20313b206d6f6465  3d626c6f636b0d0a
0190  782d636f6e74656e  742d747970652d6f
01A0  7074696f6e733a20  6e6f736e6966660d
01B0  0a0d0a557365722d  6167656e743a202a
01C0  0a446973616c6c6f  773a200a0a536974
01D0  656d61703a202f2f  6e6768747470322e
01E0  6f72672f73697465  6d61702e786d6c20
01F0  0a

0000  .P°>cf.ê.ú.R...~
0010  P^..............
0020  HTTP/1.0 200 OK.
0030  .Date: Sat, 26 O
0040  ct 2019 21:07:32
0050   GMT..Content-Ty
0060  pe: text/plain..
0070  Last-Modified: M
0080  on, 19 Aug 2019
0090  13:20:36 GMT..Et
00A0  ag: "5d5aa224-3e
00B0  "..Accept-Ranges
00C0  : bytes..Content
00D0  -Length: 62..X-B
00E0  ackend-Header-Rt
00F0  t: 0.001315..Con
0100  nection: close..
0110  Server: nghttpx.
0120  .Via: 2 nghttpx.
0130  .alt-svc: h3-23=
0140  ":4433"; ma=3600
0150  ..x-frame-option
0160  s: SAMEORIGIN..x
0170  -xss-protection:
0180   1; mode=block..
0190  x-content-type-o
01A0  ptions: nosniff.
01B0  ...User-agent: *
01C0  .Disallow: ..Sit
01D0  emap: //nghttp2.
01E0  org/sitemap.xml
01F0  .

Transmission Control Protocol, Src Port: 80, Dst Port: 45118, Seq: 1, Ack: 86, Len: 465
- Source Port: 80
- Destination Port: 45118
- TCP Segment Len: 465
- Sequence number: 1 (relative sequence number)
- Acknowledgment number: 86 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 126
- Calculated window size: 64512
- Window size scaling factor: 512
- Checksum: 0x505e [unverified]
- Urgent pointer: 0
- TCP payload (465 bytes)
Hypertext Transfer Protocol
- HTTP/1.0 200 OK\r\n
  - Response Version: HTTP/1.0
  - Status Code: 200
  - Status Code Description: OK
  - Response Phrase: OK
- Date: Sat, 26 Oct 2019 21:07:32 GMT\r\n
- Content-Type: text/plain\r\n
- Last-Modified: Mon, 19 Aug 2019 13:20:36 GMT\r\n
- Etag: "5d5aa224-3e"\r\n
- Accept-Ranges: bytes\r\n
- Content-Length: 62\r\n
  - Content length: 62
- X-Backend-Header-Rtt: 0.001315\r\n
- Connection: close\r\n
- Server: nghttpx\r\n
- Via: 2 nghttpx\r\n
- alt-svc: h3-23=":4433"; ma=3600\r\n
- x-frame-options: SAMEORIGIN\r\n
- x-xss-protection: 1; mode=block\r\n
- x-content-type-options: nosniff\r\n
- \r\n
- File Data: 62 bytes

0000 b03e005095fa0352 63660fbb800000ea
0010 d0a80000

0000 °>.P.ú.Rcf.»...ê
0010 Ð¨..

Transmission Control Protocol, Src Port: 45118, Dst Port: 80, Seq: 86, Ack: 466, Len: 0
- Source Port: 45118
- Destination Port: 80
- TCP Segment Len: 0
- Sequence number: 86 (relative sequence number)
- Acknowledgment number: 466 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 234
- Calculated window size: 234
- Window size scaling factor: -1 (unknown)
- Checksum: 0xd0a8 [unverified]
- Urgent pointer: 0

0000 0050b03e63660fbb 95fa03528000007e
0010 d2020000

0000 .P°>cf.».ú.R...~
0010 Ò...

Transmission Control Protocol, Src Port: 80, Dst Port: 45118, Seq: 466, Ack: 86, Len: 0
- Source Port: 80
- Destination Port: 45118
- TCP Segment Len: 0
- Sequence number: 466 (relative sequence number)
- Acknowledgment number: 86 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 126
- Calculated window size: 64512
- Window size scaling factor: 512
- Checksum: 0xd202 [unverified]
- Urgent pointer: 0

0000 b03e005095fa0352 63660fbc800000ea
0010 d0a60000

0000 °>.P.ú.Rcf.¼...ê
0010 Ð¦..

Transmission Control Protocol, Src Port: 45118, Dst Port: 80, Seq: 86, Ack: 467, Len: 0
- Source Port: 45118
- Destination Port: 80
- TCP Segment Len: 0
- Sequence number: 86 (relative sequence number)
- Acknowledgment number: 467 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 234
- Calculated window size: 234
- Window size scaling factor: -1 (unknown)
- Checksum: 0xd0a6 [unverified]
- Urgent pointer: 0

0000 0050af725515391c 14178134a000fe88
0010 f4f50000

0000 .P¯rU.9....4..þ.
0010 ôõ..

Transmission Control Protocol, Src Port: 80, Dst Port: 44914, Seq: 0, Ack: 1, Len: 0
- Source Port: 80
- Destination Port: 44914
- TCP Segment Len: 0
- Sequence number: 0 (relative sequence number)
- Acknowledgment number: 1 (relative ack number)
- 1010 .... = Header Length: 40 bytes (10)
- Window size value: 65160
- Calculated window size: 65160
- Checksum: 0xf4f5 [unverified]
- Urgent pointer: 0

0000 af72005014178134 0000000050000000
0010 b85b0000

0000 ¯r.P...4....P...
0010 ¸[..

Transmission Control Protocol, Src Port: 44914, Dst Port: 80, Seq: 1, Len: 0
- Source Port: 44914
- Destination Port: 80
- TCP Segment Len: 0
- Sequence number: 1 (relative sequence number)
- Acknowledgment number: 0
- 0101 .... = Header Length: 20 bytes (5)
- Window size value: 0
- Calculated window size: 0
- Window size scaling factor: 128
- Checksum: 0xb85b [unverified]
- Urgent pointer: 0

0000 0050b03e63660fbc 95fa03538000007e
0010 d0230000

0000 .P°>cf.¼.ú.S...~
0010 Ð#..

Transmission Control Protocol, Src Port: 80, Dst Port: 45118, Seq: 467, Ack: 87, Len: 0
- Source Port: 80
- Destination Port: 45118
- TCP Segment Len: 0
- Sequence number: 467 (relative sequence number)
- Acknowledgment number: 87 (relative ack number)
- 1000 .... = Header Length: 32 bytes (8)
- Window size value: 126
- Calculated window size: 64512
- Window size scaling factor: 512
- Checksum: 0xd023 [unverified]
- Urgent pointer: 0

Author(s)	Olivier Bonaventure
Deadline	No deadline
Submission limit	No limitation
Category tags	http

Information

Tags

Sign in