4

Closed

HttpResponseLayer.Body is incomplete after ExtractLayer

description

I use HttpResponseLayer to trace HTTP sessions from a WebBrowser, and I need to use the Body in my application (HttpResponseLayer.Body) but I noticed that if the http response is too large it is still limited to approximately 1200 bytes, therefore incomplete!
 
My code at last post : http://pcapdotnet.codeplex.com/discussions/245743
Closed Apr 27, 2012 at 10:32 AM by Brickner
Not reproducible.The user probably requires TCP reconstruction.

comments

Brickner wrote Feb 19, 2011 at 7:52 AM

Please look using Wireshark or other tool to see if there is more data in the packet that you don't get.
You can also attach a pcap file and I'll take a look.
I believe you just get all the available data from the packet and the HTTP response is longer than one packet (this behavior is by design since each packet is parsed independently).

Brickner wrote Oct 19, 2011 at 7:20 AM

Can you please attach an example pcap file?

Brickner wrote Apr 1, 2012 at 6:04 PM

I still couldn't see any example for this.
I believe that in the case you have the HTTP body is split over several packets and so it's impossible to get the entire body without doing TCP reconstruction.
I will close this issue unless more details are provided.

Sign in to add a comment