This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Continuation or non-HTTP traffic

0

I got a trace where appear several times the info "[TCP Fast Retransmission] Continuation or non-HTTP traffic", "[TCP Previous segment lost]Continuation or non-HTTP traffic" or [TCP Retransmission]Continuation or non-HTTP traffic".

This traces is from a user is downloading software or videos that sometimes takes 20 or 1 hour but the download is not completed. This download is from a sft server.

Please could you tell me what is this length refer?

What is the “Continuation or non-HTTP traffic”?

Do you think it is related with the downloading issue?

Thanks in advance for your help.

asked 10 Jan '12, 11:36

acoria's gravatar image

acoria
1111
accept rate: 0%


One Answer:

0

"Continuation or non-HTTP traffic" is a pretty common thing to see in traces with HTTP, usually in packets following the first with the HTTP return code. It simply tells you that this is a packet that holds further content of the page because it didn't fit into a single packet.

So unfortunately what you found is not a hint to a problem, it's just a note that this is part of a larger payload.

answered 10 Jan '12, 12:43

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

I would like to know the way Wireshark decodes the packets to find "Continuation or non-HTTP traffic" ?

(18 Jan '13, 02:02) NewportMicro

There is no good way to say this, but if you want to know how and why Wireshark does certain things you should get yourself a copy of the source code and track it down.

(18 Jan '13, 02:10) Jasper ♦♦

The HTTP header "Content-Length" informs the HTTP dissector of how much data is expected and it keeps asking the TCP dissector for more until it receives the required amount.

(18 Jan '13, 02:23) grahamb ♦