Search code examples
c#httppacket-capturesharppcap

determining HTTP packets

Greeting,

how is possible to determine from captured packets using sharppcap if the packet is http packet or not?

and can we determine frpm TCP packets if the packet is HTTP or not?

Solution

  • According to rfc2616 - Hypertext Transfer Protocol -- HTTP/1.1:

    The version of an HTTP message is indicated by an HTTP-Version field in the first line of the message

    So, you could inspect packets and scan for the HTTP version text in message headers, and/or other known fields of the HTTP protocol. Although this method may not be 100% accurate if a message is broken up into multiple packets, it would probably be good enough, at least as a first cut.