On 11/13/2014 02:08 AM, Mohamed Lrhazi wrote:
Don't really have much more to add to the subject line :)
It appears the HTTP dissector simply marks the next non-request message
as being the response to the previous request. That is, is there's a
request followed by a non-request message in the other direction then
that message is the response to the request.
I'd guess this works because HTTP is a request-response protocol (i.e.,
you can't make multiple requests on a given TCP connection without
waiting for a response). (Admittedly I don't know much about HTTP.)