URL browser origin in winpcap

Question

is there anyway to know the origin(web browser) of a certain url/packet when programming with winpcap and c++?

Answer 1

A URL is just an address string and isn't associated with any particular browser per se. A packet however is something sent, typically by an application. In the case of HTTP traffic, we can safely assume TCP. TCP packets always have 4 addressing fields: Originating IP, originating port, destination IP and destination port. Ports are assigned uniquely to a single application. In this case, the originating port will be assigned to the web browser, and the destination port to the web server.

Note that the destination port is probably 80, statically assigned to the web server, but the originating port is randomly assigned and can be reassigned later. Hence you need to look it up immediately.