Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am sniffing the in/out packets over TCP. I have some GET output, but I want to know which of the packets is the input? How does the browser determine this?

Simpler explaination: I'm sniffing and I get all GET requests, but I'm not sure how to connect them with the HTTP 200 OK ones.

share|improve this question
up vote 3 down vote accepted

To a better understanding, take a look on the entire Http article on wikipedia, but above you can see that the "handle" to the GET is coordinated by the transport layer(TCP):

An HTTP session is a sequence of network request-response transactions. An HTTP client initiates a request by establishing a Transmission Control Protocol (TCP) connection to a particular port on a server (typically port 80; see List of TCP and UDP port numbers). An HTTP server listening on that port waits for a client's request message. Upon receiving the request, the server sends back a status line, such as "HTTP/1.1 200 OK", and a message of its own. The body of this message is typically the requested resource, although an error message or other information may also be returned.

share|improve this answer
The thing is that I have 2 streams - input and output. I have to know which HTTP OK packet is the response to each GET packet, but I don't know how. – blez Mar 11 '13 at 17:57
the ordering you want occures below the HTTP layer at the TCP layer, so the sequencing is handled by the ACK and SYN values in the packets. see here for how those values get initialized and incremented with each packet in the flow: . also remember, there may not be a 1-to-1 relation between packets and requests/responses, though it is likely that most requests are sent in a single packet. – Frank Thomas Mar 11 '13 at 18:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .