Greeting,
how is possible to determine from captured packets using sharppcap if the packet is http packet or not?
and can we determine frpm TCP packets if the packet is HTTP or not?
+2
A:
According to rfc2616 - Hypertext Transfer Protocol -- HTTP/1.1:
The version of an HTTP message is indicated by an HTTP-Version field in the first line of the message
So, you could inspect packets and scan for the HTTP version text in message headers, and/or other known fields of the HTTP protocol. Although this method may not be 100% accurate if a message is broken up into multiple packets, it would probably be good enough, at least as a first cut.
Justin Ethier
2010-04-16 02:57:17
Thank you Justin for your reply.what I understand in case I captured TCP packet can I determine from the data field if there is HTTP message?
Eyla
2010-04-16 03:36:57
+1
A:
It sounds like you're looking at a single TCP fragment. If that came from the beginning of a message, it will have an HTTP version in the first line, but if you're just pulling random packets off the network and hoping to be able to tell they're HTTP you're out of luck - there is nothing in the TCP fragments which indicates what is in them. The only way to know would be to look at the whole conversation.
Stewart
2010-04-16 05:46:58
A:
I'm the author/maintainer of sharppcap/packet.net.
I have a few classes that perform tcp reassembly and http parsing that are in use in a complex network monitoring app to identify and follow http sessions. These are fully unit tested and well commented.
They are available for licensing either at the binary or source level. Contact me at [email protected] if you are interested or want more info.
Edit: Why vote this down? It took hundreds of hours to develop the code and tests and it's a drop in solution that has been reused. It's certainly worth considering before reimplementing the same functionality.
Chris Morgan
2010-04-16 16:13:38