This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I found a really weird statistics on wireshark. For a video transmission on Android I opened up the stats for protocol hierarchy, the stats shows that the 3MB video doesn't go through HTTP.

However, when I clicked "save the objects" , wireshard shows the 3MB as "video/mp4" through HTTP. (It's like it resembles the packages).

Now I'm confused whether the video on Android is sent through HTTP or not.., or HTTPS?

Thank you !

asked 13 Nov '12, 13:34

miramiram's gravatar image

miramiram
1111
accept rate: 0%

edited 14 Nov '12, 03:31

grahamb's gravatar image

grahamb ♦
19.8k330206


Because HTTP re-assembles the TCP stream, most packets are marked as "[TCP segment of a reassembled PDU]". Those packets are not counted as HTTP in the protocol hierarchy.

You can disable the reassembly of packets by right-clicking on "Transmission Control Protocol" in the packet details pane. Then choose "Protocol Preferences" and deselect "Allow subdissector to reassemble TCP streams".

Then your HTTP response will not get reassembled and all HTTP packets will be counted as HTTP.

permanent link

answered 14 Nov '12, 02:54

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×69

question asked: 13 Nov '12, 13:34

question was seen: 1,651 times

last updated: 14 Nov '12, 03:31

p​o​w​e​r​e​d by O​S​Q​A