how to know if a packet sniffed is accessed from a website directly and not linked?

views:

answers:

how to know if a packet sniffed is accessed from a website directly and not linked?

is there any way to know if a certain tcp segment which has a request message to a server is directly accessed by a user through a browser. not just that its linked by the browser itself to complete the requested page. like for example, a web page with images, when one browses this page, the sniffer tends to get all this urls including the web page's and that of the images. what factors would let me identify which is which?!...

thanks alot in advance:)

+1 A:

Nope.

I just confirmed this using the Ethereal packet sniffer on a 1996-style brochureware site that had a few embedded gifs. There is nothing about the secondary HTTP GET request packets that distinguish them from my original GET.

If you want to get meta-analytic, I'd be impressed if someone could click as fast as the browser issues the subsequent auto-requests, but wget would be as fast. I wouldn't use this evidence to hang a man nor exonerate him.

msw 2010-03-01 08:26:16

There is an HTTP header for that that a browser can set to tell the server which page the requested URL appeared on:

http://www.w3.org/Protocols/HTTP/HTRQ_Headers.html#z14

I believe the major browsers set this header when requesting resources (images, css, js), as well as when one clicks on a link, but I'm not sure. Browsers aren't required to set this header. Even when the header is set, the browser could be lying. There's no way for anyone else to know, at least not that I know of.

allyourcode 2010-03-01 08:31:00

Relying on a referer is a very bad idea - where the borwser does return data, it will also return a referer for web pages themselves. The nearest you'll get to what the OP is looking for is by sniffing the mime-type - typically only text/html mime types are returned by the requested URL whereas they are rarely requested by the user selected document - however this presupposes that the server is correctly configured to return the right mimetype.

symcbean 2010-03-07 00:25:42

I believe he is basically asking if there's a way to tell whether the user clicked on a link vs. typing the URL in the url bar or using a bookmark. When Referer is set, you can infer that that the user clicked on a link to get to the page as opposed to some other method.

allyourcode 2010-03-07 03:29:26

ansaurus

tags:

views:

answers:

how to know if a packet sniffed is accessed from a website directly and not linked?

related questions