Question

I have a function that gets all packets (in and out). I'm monitoring for GET and HTTP 200 OK. All works fine, but how to link the GET request with its OK response?

EDIT: I want to know how to do it programically. I know that professional sniffers can 'follow traffic'

Was it helpful?

Solution

You could use the source and destination ports of the request and response to link it to the same TCP stream.

CLIENT > TCP SRC 33333 DST 80 "GET / HTTP/1.1"
SERVER < TCP SRC 80 DST 33333 "200 OK"

OTHER TIPS

If you just want to read the traffic you can always use WireShark. It has a function to "Follow TCP Stream". If you want to program a sniffer, I would suggest lecture of http://en.wikipedia.org/wiki/Transmission_Control_Protocol.

You can use justniffer. it is extendible by scripts. a new version not yes released in trunk branch of repository is extedible by python.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top