This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

TCP- induced “Continuation” question.

0

My homework is asking this question: Are there any HTTP status lines in the transmitted data associated with a TCP- induced “Continuation”? The text previous to the question states: In the packet-listing window, you should see your HTTP GET message, followed by a multiple-packet response to your HTTP GET request. This multiple-packet response deserves a bit of explanation. Recall from Section 2.2 (see Figure 2.9 in the text) that the HTTP response message consists of a status line, followed by header lines, followed by a blank line, followed by the entity body. In the case of our HTTP GET, the entity body in the response is the entire requested HTML file. In our case here, the HTML file is rather long, and at 4500 bytes is too large to fit in one TCP packet. The single HTTP response message is thus broken into several pieces by TCP, with each piece being contained within a separate TCP segment (see Figure 1.24 in the text). Each TCP segment is recorded as a separate packet by Wireshark, and the fact that the single HTTP response was fragmented across multiple TCP packets is indicated by the “Continuation” phrase displayed by Wireshark. We stress here that there is no “Continuation” message in HTTP!

I do not see any thing that says "Continuation" displayed by WireShark in any of the status lines for the TCP traffic but there must be something that Im missing. Will I see the word Continuation or can the Continuation look like something else? I see my GET request and then TCP traffic and finally the 200 OK response from the server. Is the TCP traffic the Continuation? Here is a CloudShark link to the data: http://www.cloudshark.org/captures/dd413b6a1b45?filter=tcp

So #s 36 - 42 is what Im looking at. First 36 is my GET request, then 37 - 41 is TCP traffic and finaly 42 is the server saying 200 OK telling me that the request was fulfilled. Is the 37 - 41 the Continuation?

Thanks for the help.

asked 09 Mar '13, 18:48

SydneyLebowitz's gravatar image

SydneyLebowitz
11113
accept rate: 0%

edited 09 Mar '13, 18:59


One Answer:

0

Select any TCP packet. In the Packet Details pane, right-click on the "Transmission Control Protocol" summary line, select "Protocol Preferences" and uncheck "Allow subdissector to reassemble TCP streams."

You can do the same thing by going to Edit > Preferences > Protocols > TCP.

answered 09 Mar '13, 21:08

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%