Why do some packets with http protocol have reference to other packets in Wireshark?

Question

I have captured traffic using Wireshark and applied HTTP filter. Some requests have fields [HTTP request 1/(any number)] and [Next request in frame: packet_number].

Why do some packets have [HTTP request 1/2] and [Next request in frame: ###] fields?

jim · Accepted Answer · 2016-08-29 18:58:59Z

1

In most cases, a browser creates a new TCP session for every HTTP request, but sometimes when two or more resources belong to the same destination the browser will try to GET them all in the same TCP session (also referred as the stream in Wireshark). This is when [HTTP request 1/(any number)] gets printed out for the first of those requests.

answered Aug 29, 2016 at 18:58

jim

9067 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

packetie · Accepted Answer · 2015-11-24 03:31:46Z

0

That most likely means the HTTP message span over multiple TCP data packets. A snapshot of what you see would have been helpful.

answered Nov 24, 2015 at 3:31

packetie

5,10712 gold badges42 silver badges81 bronze badges

Collectives™ on Stack Overflow

Why do some packets with http protocol have reference to other packets in Wireshark?

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related