Sniffer - How to link the GET requests with their response?

Question

I have a function that gets all packets (in and out). I'm monitoring for GET and HTTP 200 OK. All works fine, but how to link the GET request with its OK response?

EDIT: I want to know how to do it programically. I know that professional sniffers can 'follow traffic'

Answer 1

You could use the source and destination ports of the request and response to link it to the same TCP stream.

CLIENT > TCP SRC 33333 DST 80 "GET / HTTP/1.1"
SERVER < TCP SRC 80 DST 33333 "200 OK"