Search code examples
tcpwiresharkcontent-length

Post Request reassembled TCP segment greater than content-length

I used wireshark to check post request and I found that the reassembled TCP segment size greater than the content-length , is that because content-length is for the size of body only ? and the ressambled includes the header ?

[3 Reassembled TCP Segments (1664 bytes): #1233(578), #1235(1028), #1237(58)]
[Frame: 1233, payload: 0-577 (578 bytes)]
[Frame: 1235, payload: 578-1605 (1028 bytes)]
[Frame: 1237, payload: 1606-1663 (58 bytes)]
[Segment count: 3]

 [Reassembled TCP length: 1664]

Hypertext Transfer Protocol
content-length: 1249\r\n
Solution

  • is that because content-length is for the size of body only

    Correct. Content-length describes only the length of the message body. From the HTTP standard:

    14.13 Content-Length
    The Content-Length entity-header field indicates the size of the entity-body, in decimal number of OCTETs ...

     

    ... and the ressambled includes the header ?

    Given that you show parts of the header which is included in the reassembled data these data obviously contain at least part of the header.