Lab Objective:
Learn how the Hypertext Transfer Protocol (HTTP) works and why is it used.
Lab Purpose:
Understand the main purpose of HTTP and the features of the protocol.
Lab Tool:
Wireshark installed on a PC, Ethernet switch or router (cable/Wi-Fi).
Lab Topology:
Use the topology shown in the figure below to complete this lab exercise. A PC (equipped with Wireshark) is connected through a wireless or cable connection to a network router that has access to the Internet.
Lab Walkthrough:
Task 1:
HTTP is referred to as a “distributed hypermedia information distribution application.” HTTP application is used when you browse the Internet (in an unsecured way). There are different versions of HTTP—the current version is v2.0; the most used version is v1.1, but sometimes v1.0 is also used.
Normal HTTP communication uses a request/response communication model in which a client sends a request to an HTTP server and the server responds with the status code.
Open Wireshark, and on the main menu, select Capture > Options. Select an interface for which the line graph displays some activity in the Traffic column. Capture the traffic for a few minutes.
In a web browser, go to http://info.cern.ch/ and inspect some links on the main page. Stop the capture in Wireshark and save the file, naming it cernHttp.pcapng.
In the filter toolbar, enter http. The results will be similar to the figure below.
In the figure above, only the HTTP packets are displayed in the Packet List pane.
If you apply the display filter ip.addr == 188.184.64.53, all packets exchanged with the remote server are displayed in the Packet List pane. In this case, the remote server IP address is 188.184.64.53. When you select the first HTTP packet in the Packet List pane, this IP address is also displayed as the destination in the Packet Details pane. Note that this IP address may change if the server is moved. You can check the HTTP output and verify the IP address.
The figure below indicates packet loss and very poor response time. Moreover, it shows that some TCP retransmission occurred before the HTTP communication started.
As shown in the figure below, the client made a three-way TCP handshake from port 54388 to port 80. In the Info column, packets #80, #85, and #86 are listed as HTTP because transport name resolution is enabled.
By default, Wireshark is configured to dissect HTTP on the following ten ports: 80, 3128, 3132, 5985, 8080, 8088, 11371, 1900, 2869, and 2710. However, other ports can also be used for HTTP communication. You can specify the ports in the Preferences dialog box. On the main menu, select Edit > Preferences. In the left tree view, select Protocols then HTTP and then enter the ports in the TCP port(s) box.
To capture HTTP traffic that is running on another port, simply add the port number to the HTTP preferences.
After the TCP connection is established successfully, the client makes an HTTP GET request for “/” (packet #157). The server responds with the status code 200 OK and begins sending the contents of the main page to the client.
The following are all available status codes from the HTTP Status Code Registry, grouped by type such as info, success, error.
1xx Informational
100 Continue
101 Switching Protocols
102 Processing
2xx Success
200 OK
201 Created
202 Accepted
203 Non-Authoritative Information
204 No Content
205 Reset Content
206 Partial Content
207 Multi-Status
208 Already Reported
226 IM Used
3xx Redirection
300 Multiple Choices
301 Moved Permanently
302 Found
303 See Other
304 Not Modified
305 Use Proxy
306 Reserved
307 Temporary Redirect
308 Permanent Redirect
4xx Client Error
400 Bad Request
401 Unauthorized
402 Payment Required
403 Forbidden
404 Not Found
405 Method Not Allowed
406 Not Acceptable
407 Proxy Authentication Required
408 Request Timeout
409 Conflict
410 Gone
411 Length Required
412 Precondition Failed
413 Request Entity Too Large
414 Request-URI Too Long
415 Unsupported Media Type
416 Requested Range Cannot Be Satisfied
417 Expectation Failed
422 Unprocessable Entity
423 Locked
424 Failed Dependency
425 Reserved for WebDAV
426 Upgrade Required
428 Precondition Required
429 Too Many Requests
431 Request Header Fields Too Large
5xx Server Error
500 Internal Server Error
501 Not Implemented
502 Bad Gateway
503 Service Unavailable
504 Gateway Timeout
505 HTTP Version Not Supported
506 Variant Also Negotiates (Experimental)
507 Insufficient Storage
508 Loop Detected
510 Not Extended
511 Network Authentication Required
Task 2:
To make the HTTP view clearer, in the Preferences dialog box, select HTTP and clear the options related to “Allow subdissector to reassemble TCP streams”, as shown in the figure below.
The result of this preference change is displayed in the Packet List pane, as shown in the figure below. Each individual HTTP message is now displayed as a single packet.
Task 3:
Start a capture again on the active interface. In a web browser, reload http://info.cern.ch/. Stop the capture.
If an HTTP client has visited a page recently and that page is cached locally, the client may send the IfModified-Since parameter and provide a date and time of the previous page download. If the page is not modified, the server responds with the 304 – Not Modified code. The server does not resend the page that is already cached. This is applicable in this case because you recently visited the home page. When analysing HTTP performance, this is an important aspect of HTTP to understand. In fact, when analysing the capture packets, you must ensure that the pages are not reloaded from the cache. Otherwise, you won’t be able to see the full-page download. The following figure shows this scenario.
Note:
Repeat the previous steps on different websites using the HTTP protocol and observe the HTTP messages. Identify the connection establishment and try to understand whether the performance of the server is good.
