-1

I'm using a sniffer and I would like to know is there a way to tell a download packet from a packet that comes up when you go to a website? Are the headers different? If so, what is the difference? Is the size different? Any clarification is appreciated.

vezult
  • 5,185
  • 25
  • 41
DSTR3
  • 31
  • 4
  • 1
    Please explain what exactly you mean by *"a download packet"* and *"a packet that comes up when you go to a website"*. – NPE Aug 04 '11 at 15:38
  • My sniffer shows me the IP's, sequence and header of a website that I visit. However I need to differentuate between just visiting a site and downloading from a site, how can I do this? – DSTR3 Aug 04 '11 at 17:43

1 Answers1

1

It's not 100% clear what you mean, but the browser will use the Content-Type and Content-Disposition headers to decide whether to display a resource in the browser or to show the Download prompt. Is that what you meant?

RichieHindle
  • 272,464
  • 47
  • 358
  • 399
  • Yes it is! Thank you! Now how van I access this information? Where does it reside? Will my Sniffer see it? Any info will be helpful! – DSTR3 Aug 04 '11 at 15:55
  • The headers are at the beginning of the HTTP response. If your sniffer can see the HTTP packets, it can see the response headers. Have a look with Wireshark, Fiddler, etc. – RichieHindle Aug 04 '11 at 16:04