0

I used wireshark to check post request and I found that the reassembled TCP segment size greater than the content-length , is that because content-length is for the size of body only ? and the ressambled includes the header ?

[3 Reassembled TCP Segments (1664 bytes): #1233(578), #1235(1028), #1237(58)]
[Frame: 1233, payload: 0-577 (578 bytes)]
[Frame: 1235, payload: 578-1605 (1028 bytes)]
[Frame: 1237, payload: 1606-1663 (58 bytes)]
[Segment count: 3]

 [Reassembled TCP length: 1664]

Hypertext Transfer Protocol
content-length: 1249\r\n
Steffen Ullrich
  • 114,247
  • 10
  • 131
  • 172
Mohammad Karmi
  • 1,403
  • 3
  • 26
  • 42

1 Answers1

1

is that because content-length is for the size of body only

Correct. Content-length describes only the length of the message body. From the HTTP standard:

14.13 Content-Length
The Content-Length entity-header field indicates the size of the entity-body, in decimal number of OCTETs ...

 

... and the ressambled includes the header ?

Given that you show parts of the header which is included in the reassembled data these data obviously contain at least part of the header.

Steffen Ullrich
  • 114,247
  • 10
  • 131
  • 172