This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

HTTP transmission or not???

0

I found a really weird statistics on wireshark. For a video transmission on Android I opened up the stats for protocol hierarchy, the stats shows that the 3MB video doesn't go through HTTP.

However, when I clicked "save the objects" , wireshard shows the 3MB as "video/mp4" through HTTP. (It's like it resembles the packages).

Now I'm confused whether the video on Android is sent through HTTP or not.., or HTTPS?

Thank you !

asked 13 Nov '12, 13:34

miramiram's gravatar image

miramiram
1111
accept rate: 0%

edited 14 Nov '12, 03:31

grahamb's gravatar image

grahamb ♦
19.8k330206


One Answer:

1

Because HTTP re-assembles the TCP stream, most packets are marked as "[TCP segment of a reassembled PDU]". Those packets are not counted as HTTP in the protocol hierarchy.

You can disable the reassembly of packets by right-clicking on "Transmission Control Protocol" in the packet details pane. Then choose "Protocol Preferences" and deselect "Allow subdissector to reassemble TCP streams".

Then your HTTP response will not get reassembled and all HTTP packets will be counted as HTTP.

answered 14 Nov '12, 02:54

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%