Search code examples
wiresharkpacket-capture

How to find the number of content of bytes returned to browser by the server

I am new to wireshark and trying to solve simple examples. I captured a simple html file and the question i am trying to answer is: "How many bytes of content are being returned to your browser?".

I am confused here. Let me first show the screenshot here:

enter image description here

I see two things when i click on the "OK" message received from the server. First it says 540 bytes captured, and second it also says that content length is 232. Which one is the answer to my question and what is the difference between these two numbers? Can anyone explain?

Thanks

Solution

  • The two numbers are measuring different things. The Content-Length is the actual size of the HTTP response body in bytes (only the body, so not including the headers), whereas the 540 is the total size of the network frame including the IP and TCP protocol overhead and the HTTP headers.