Wireshark-users: Re: [Wireshark-users] Finding mismatched HTTP Content-Length and the data
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Mon, 27 Oct 2008 21:16:38 -0600
On Tue, Oct 28, 2008 at 10:59:13AM +0800, Ducky wrote:

> I'm trying to find the web server's response that includes a 
> Content-Length header that indicates a smaller value than the length 
> of the data in the response. For example, if the web server sends a 
> response with a Content-Length header value of 10 bytes, but the data 
> size of the response is more than 10 bytes
> 
> I am able to find the data length, by clicking on the data part of the 
> packet and manually check against the Content-Length in header. It's 
> too painful for me to look through thousands of packets.

This would be fairly easy to add to the HTTP dissector.  However I am 
wondering what the best way to do it would be and whether this is a 
common enough problem to warrant such a validation in Wireshark?


Steve