0

I am new to wireshark and trying to solve simple examples. I captured a simple html file and the question i am trying to answer is: "How many bytes of content are being returned to your browser?".

I am confused here. Let me first show the screenshot here:

enter image description here

I see two things when i click on the "OK" message received from the server. First it says 540 bytes captured, and second it also says that content length is 232. Which one is the answer to my question and what is the difference between these two numbers? Can anyone explain?

Thanks

yrazlik
  • 10,411
  • 33
  • 99
  • 165

1 Answers1

3

The two numbers are measuring different things. The Content-Length is the actual size of the HTTP response body in bytes (only the body, so not including the headers), whereas the 540 is the total size of the network frame including the IP and TCP protocol overhead and the HTTP headers.

Ian Roberts
  • 120,891
  • 16
  • 170
  • 183
  • 1
    Thanks! So, which one is the anseer to the quetion "How many bytes of content are being returned to your browser?". Do we consider only the body, or we consider the total size of the network frame? – yrazlik Nov 26 '13 at 18:30
  • @panpa it depends what you mean by "content". If you just mean the response body then it's the Content-Length, if you want to include the HTTP headers then it'll be somewhere between 232 and 540. It's not all the 540 because that includes overhead that's stripped off within the protocol stack and doesn't get as far as the browser. – Ian Roberts Nov 26 '13 at 19:59