I got a trace where appear several times the info "[TCP Fast Retransmission] Continuation or non-HTTP traffic", "[TCP Previous segment lost]Continuation or non-HTTP traffic" or [TCP Retransmission]Continuation or non-HTTP traffic". This traces is from a user is downloading software or videos that sometimes takes 20 or 1 hour but the download is not completed. This download is from a sft server. Please could you tell me what is this length refer? What is the “Continuation or non-HTTP traffic”? Do you think it is related with the downloading issue? Thanks in advance for your help. asked 10 Jan '12, 11:36  acoria |
One Answer:
"Continuation or non-HTTP traffic" is a pretty common thing to see in traces with HTTP, usually in packets following the first with the HTTP return code. It simply tells you that this is a packet that holds further content of the page because it didn't fit into a single packet. So unfortunately what you found is not a hint to a problem, it's just a note that this is part of a larger payload. answered 10 Jan '12, 12:43  Jasper ♦♦ |
I would like to know the way Wireshark decodes the packets to find "Continuation or non-HTTP traffic" ?
There is no good way to say this, but if you want to know how and why Wireshark does certain things you should get yourself a copy of the source code and track it down.
The HTTP header "Content-Length" informs the HTTP dissector of how much data is expected and it keeps asking the TCP dissector for more until it receives the required amount.