Small knowledge, big challenge! Wireshark is used to capture HTTP response packets. Wireshark is used to capture HTTP response packets. Wireshark is used to capture HTTP response packets
The response message
We can filter out the desired packets in wireshark. For example, I can filter out the normal response packets by entering HTTP.response. code == 200 in the filter box, as shown in the following figure. Message header and response body
The port number
When you first contact this packet, you may wonder why the HTTP port number 80 is displayed in the TCP layer, because HTTP uses TCP to transmit data, and TCP can transmit not only HTTP packets, but also other packets, so how to distinguish these different packets is through this port number. For example, port 21 indicates that FTP packets are transmitted, port 22 indicates that SSH packets are transmitted, and port 25 indicates THAT SMTP packets are transmitted. The Wireshark is used to filter packets from other applications
The HTTP status line
Protocol version
In the status line, you can see that the current protocol version is HTTP /1.1,
Status code
The status code of the packet is 200, which is very important. I think we should memorize common ones just like learning the text. When we see the returned status code, we will know roughly where the problem is, and all the status codes will not be listed here.
There are five types of status codes:
A — message beginning with 1, indicating that the server has received the request and needs the requester to continue, which is unusual
A value starting with 2 indicates that the operation is successful. A common value of 200 indicates that the request is successful
3 – redirect, further action required to complete the request, 301 – resources (web pages, etc.) permanently transferred to another URL
4 – client error, common 404 means resource does not exist, 403 means no permissions
5 – Server error, common 500 error, indicating server internal error, 504 gateway timeout (often encountered when user login error occurs)
Status code Description
Http.response.code. desc: OK This is the description of a status code
The HTTP headers
In the message header, you can see the time and date of the response, the encoding type of the returned content, the length of the returned content, and other information
In response to the body
In the sample screenshot, the returned HTML source content depends on what you are requesting and what you are returning. If the returned content does not match the expected content, you should check it in detail
Knowing the structure of the message in detail makes it easy for us to analyze and construct, and then use other tools such as Postman to construct some HTTP requests for testing.