Search code examples
httppackethttp2

Differentiating http and http2 packets

I'm working with packets one by one and need to be able to edit both http and http2 contents.

The question is: is there a way to distinguish the two on a single packet basis?

Edit: For some additional info, the point is to read and edit large pcap files, so i'm trying to work with as little memory as possible.

Solution

  • On a per-packet basis, no. A single TCP packet could represent any arbitrary part of the stream. You need to capture (at least) the first part of the stream to work out whether it's HTTP or HTTP/2 (or anything else).