Matthew Stoney

CST-311, Millan/Pham
09/11/2021
Lab 2: Wireshark HTTP

1. Both my browser and the server are running HTTP/1.1

2. My browser’s Accept-Language field has the value, en-US,en;q=0.9, indicating it
accepts US English language.
3. The IP address of my computer is 10.0.0.25. The address of the gaia.cs.umass.edu
server is 128.119.245.12.
4. The status code returned from the server to my browser is 200 OK.
5. The HTML file retrieved was last modified Sat, 11 Sep 2021 05:59:01 GMT.
6. Wireshark shows the content length of the response is 128 bytes. However, the
total length of the response is 540 bytes.
7. No, the headers in the raw data are the same for both the request and response
messages. The only difference is the server’s response contains the HTML of the
webpage in the entity body of the response message.
8. No, the first HTTP GET request does not have an “IF-MODIFIED-SINCE” line
in the header.
9. Yes, I think the server explicitly returned the file because it gave a 200 OK
response instead of a 304 NOT MODIFIED or some other response.
10. Yes, the second HTTP GET request has a “IF-MODIFIED-SINCE” header field
that has the date value Sat, 11 Sep 2021 05:59:01 GMT.
11. The HTTP status code and phrase returned for this second GET request is 304 Not
Modified. This means the server did not explicitly return the contents of the file,
but instead there was already an up-to-date copy of the file in the browser’s cache.
12. My browser only sent a single HTTP GET request for the file. The first packet in
the trace contains the GET message for the Bill of Rights.
13. The second packet has the status code and phrase for the response.
14. The response was 200 OK.
15. There were four reassembled TCP segments needed to transfer the Bill of Rights
in the HTTP response.
16. There was a total of three GET requests sent for this address. The first two
requests were sent to the gaia.cs.umass.edu server. The third one was sent to the
server http://kurose.cslash.net.
17. I think that the two images were downloaded in parallel. This is because the
timestamps on both the HTTP response messages for the images are identical.
18. The server’s initial response is a 401 Unauthorized.
19. When the browser sends the second GET request, it now contains the
authorization field. The value of this field is the encoded form of the username
and password we entered to login to the site.