Sniffer - How to link the GET requests with their response?

Question

I have a function that gets all packets (in and out). I'm monitoring for GET and HTTP 200 OK. All works fine, but how to link the GET request with its OK response?

EDIT: I want to know how to do it programically. I know that professional sniffers can 'follow traffic'

Answer 1

You could use the source and destination ports of the request and response to link it to the same TCP stream.

CLIENT > TCP SRC 33333 DST 80 "GET / HTTP/1.1"
SERVER < TCP SRC 80 DST 33333 "200 OK"

Answer 2

If you just want to read the traffic you can always use WireShark. It has a function to "Follow TCP Stream". If you want to program a sniffer, I would suggest lecture of http://en.wikipedia.org/wiki/Transmission_Control_Protocol.

Answer 3

You can use justniffer. it is extendible by scripts. a new version not yes released in trunk branch of repository is extedible by python.