locked
What is ContentLength in a capture? RRS feed

  • Question

  • I have a capture from an HTTP request and wanted to confirm that the ContentLength property is the "size" of the request/packet sent to the webserver.

    So I have ContentLength=2414.  This mean the size is 2414 bytes (2.4K)...Is this correct?

    Is there anything else I need to look at to determine the size of the message sent to the webserver?

    Thanks

    Wednesday, February 3, 2010 12:01 AM

Answers

  • My pleasure.  I think we're both right. :)

    Sorry for the confusion, I was looking from the client perspective and capturing on the person requesting the webpage.  But I believe you're talking about capturing on the actual webserver recieving all the requests, correct?

    If that's the case, then we should both be correct, we're just looking at different ends of the same connection.

    According to the RFC (s14.13), it looks like the Content Length should be the length of the content itself, but there seems to be a few exceptions.  I'm not sure if there's much more I'd be able to tell you, as I said, I'm not a protocol expert.  But if you explain your situation more, I might be able to suggest some alternatives, if the Content Length isn't quite what you need.

    Sorry, TCPPayloadLength is actual "Property.TCPPayloadLength", you won't find it under TCP itself.  I believe we changed these parsers at somepoint too, so if you're on the default 3.3 install, then it might be a bit different as I'm using the latest parsers available at http://nmparsers.codeplex.com/.


    Michael Hawker | Program Manager | Network Monitor
    • Marked as answer by Troy L. Martin Wednesday, February 3, 2010 10:45 PM
    Wednesday, February 3, 2010 5:37 PM

All replies

  • Hi,

    I'm not a protocol expert, but from the looks of things, you should only ever see the Content Length Property with Response packets from the webserver.  You can see this if you find the "Content Length" field in the Frame Details window and right-click and select "Go To Data Field Definition".  Scrolling up, you'll see this is in the Header Fields loop which is in the Response structure.

    The property should be the same value as this field, but it's contained in the packet sent by the webserver, and I've seen cases where it doesn't seem to match the actual payload length of the final packet (not sure why).

    Assuming, you just want to know the length of the HTTP portion of the Request being sent to the webserver, I believe the TCPPayloadLength property would be more what you're looking for.

    Hope that's a better starting point for you,
    Michael Hawker | Program Manager | Network Monitor
    Wednesday, February 3, 2010 12:45 AM
  • Thanks for responding, Michael.

    I'm not finding TCPPayloadLength...however, I do see PayloadLen: 298 listed in the TCP portion of the frame.  On another note, I have read a number of other blogs and forum postings and they all state that ContentLength is the size of the message/packet/data the source is sending to the destination.  To add to that, the HTTP repsonse portion of the response/return from the webserver does not have a ContentLength field.

    I'm a little confused...

    I'm sure you know what you're talking about, but I'm confused because I'm seeing the exact opposite what you're saying?  Do you have any reason to believe that the ContentLength field means something other than the size of the data being sent and that I should not see that field in the HTTP request?
    Wednesday, February 3, 2010 2:57 AM
  • My pleasure.  I think we're both right. :)

    Sorry for the confusion, I was looking from the client perspective and capturing on the person requesting the webpage.  But I believe you're talking about capturing on the actual webserver recieving all the requests, correct?

    If that's the case, then we should both be correct, we're just looking at different ends of the same connection.

    According to the RFC (s14.13), it looks like the Content Length should be the length of the content itself, but there seems to be a few exceptions.  I'm not sure if there's much more I'd be able to tell you, as I said, I'm not a protocol expert.  But if you explain your situation more, I might be able to suggest some alternatives, if the Content Length isn't quite what you need.

    Sorry, TCPPayloadLength is actual "Property.TCPPayloadLength", you won't find it under TCP itself.  I believe we changed these parsers at somepoint too, so if you're on the default 3.3 install, then it might be a bit different as I'm using the latest parsers available at http://nmparsers.codeplex.com/.


    Michael Hawker | Program Manager | Network Monitor
    • Marked as answer by Troy L. Martin Wednesday, February 3, 2010 10:45 PM
    Wednesday, February 3, 2010 5:37 PM
  • Hi,

    I'm not a protocol expert, but from the looks of things, you should only ever see the Content Length Property with Response packets from the webserver.  You can see this if you find the "Content Length" field in the Frame Details window and right-click and select "Go To Data Field Definition".  Scrolling up, you'll see this is in the Header Fields loop which is in the Response structure.

    The property should be the same value as this field, but it's contained in the packet sent by the webserver, and I've seen cases where it doesn't seem to match the actual payload length of the final packet (not sure why).

    Assuming, you just want to know the length of the HTTP portion of the Reuest being sent to the webserver, I believe the TCPPayloadLength property would be more what you're looking for.

    Hope that's a better starting point for you,
    Michael Hawker | Program Manager | Network Monitor

    It's very valuable, It helps me out of the problem, Many thanks to your description!
    Monday, September 6, 2010 3:41 AM