wireshark-lab2-http

GET代表从浏览器向服务器发送请求，后面的HTTP就是回复，text/html代表回复文本的类型

1. Is your browser running HTTP version 1.0, 1.1, or 2? What version of HTTP is the server running?
   1.1；1.1.
2. What languages (if any) does your browser indicate that it can accept to the server?
   zh-CN
3. What is the IP address of your computer? What is the IP address of the gaia.cs.umass.edu server?
   192.168.31.94;128.119.245.12
4. What is the status code returned from the server to your browser?
   200
5. When was the HTML file that you are retrieving last modified at the server?
   Tue,07 Sep 2021 05:57:01
6. How many bytes of content are being returned to your browser?
   128
7. By inspecting the raw data in the packet content window, do you see any headers within the data that are not displayed in the packet-listing window? If so, name one.
   什么意思没看懂。。。。

GMT:格林威治标准时间 OpenSSL：开放安全套接字层协议软件库包

8. Inspect the contents of the first HTTP GET request from your browser to the server. Do you see an “IF-MODIFIED-SINCE” line in the HTTP GET?
   No

9. Inspect the contents of the server response. Did the server explicitly return the contents of the file? How can you tell?
   yes,in the Line-based text data: text/html (10 lines)

10. Now inspect the contents of the second HTTP GET request from your browser to the server. Do you see an “IF-MODIFIED-SINCE:” line in the HTTP GET ? If so, what information follows the “IF-MODIFIED-SINCE:” header?
    Tue,07 Sep 2021 05:59:01 GMT，后面跟着的是修改数据的标准时间

11. What is the HTTP status code and phrase returned from the server in response to this second HTTP GET? Did the server explicitly return the contents of the file? Explain.
    304,Not Modified;
    If-Modified-Since 是一个条件式请求首部，服务器只在所请求的资源在给定的日期时间之后对内容进行过修改的情况下才会将资源返回，状态码为 200 。如果请求的资源从那时起未经修改，那么返回一个不带有消息主体的 304 响应，而在 Last-Modified 首部中会带有上次修改时间。
    也就是说浏览器起先有一个缓存文件存在硬盘里，当浏览器向服务器发送请求的时候，会把文件最后一次缓存的时间一起发过去，服务器比对最后一次修改的时间，如果相同，那么直接显示浏览器原先缓存的文件，并返回304
    如果不同，那么服务器就会重新发送文件给浏览器，并返回200

12. How many HTTP GET request messages did your browser send? Which packet number in the trace contains the GET message for the Bill or Rights?
    one,the first.

13. Which packet number in the trace contains the status code and phrase associated with the response to the HTTP GET request?
    the second.

14. What is the status code and phrase in the response?
    200,OK.

15. How many data-containing TCP segments were needed to carry the single HTTP response and the text of the Bill of Rights?
    4 Reassembled TCP Segments.
    (4861 bytes):#13(1400),#14(1400),#15(1400),#16(661)
    [Frame: 13, payload: 0-1399 (1400 bytes)]
    [Frame: 14, payload: 1400-2799 (1400 bytes)]
    [Frame: 15, payload: 2800-4199 (1400 bytes)]
    [Frame: 16, payload: 4200-4860 (661 bytes)]
    TCP报文段总共4891字节，被分成4段，数据有4861字节，TCP首部20字节，还有10字节我也不知道是啥，（TCP一段最大字节数为1400）

16. How many HTTP GET request messages did your browser send? To which Internet addresses were these GET requests sent?
    two,128.119.245.12

17. Can you tell whether your browser downloaded the two images serially, or whether they were downloaded from the two web sites in parallel? Explain.
    ip目的地址相同，所以应该是从一个网站上下的图片，Etag指明两张图片在服务器上的位置

进入有密码的网站，一共发送了6个报文段
前两个是浏览器与服务器的连接报文
第三个浏览器向服务器发送用户名
（Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9\r\n）代表输入框的图片
第四确认用户名是否正确
第五个浏览器发送用户名的密码
第六个进入网站，显示输入成功提示
Authorization: Basic d2lyZXNoYXJrLXN0dWRlbnRzOm5ldHdvcms=
用base64解码器解码出来就是用户名和密码
18. What is the server’s response (status code and phrase) in response to the initial HTTP GET message from your browser?
401,unauthorized.(401，未授权)
19. When your browser’s sends the HTTP GET message for the second time, what new field is included in the HTTP GET message?
username