Sniffing HTTP traffic

[Martijn van Oosterhout]

On Thu, Apr 04, 2002 at 12:05:41PM +0200, Arabella Riu wrote:
> Hallo everybody!
> 
> I need to detect when a connection is interrupted with the Stop Botton 
> of Netscape.
> I tried to observe the output of tcpdump but is really inpossible to
> distinguish between the packets that are consequence of the interruption
> of a connection and the normal packets for a terminated connection.
> 
> Sombody could help me?

My first reaction would be that the Stop button closes the connection and
thus looks no different from a normal termination.

That said, it's possible that when pushing Stop the receiving end may
produce a few RST packets which may not appear on normal termination. Maybe
you can check which end terminated the connection?

It's certainly not an obvious question.
-- 
Martijn van Oosterhout <kleptog at svana.org>   http://svana.org/kleptog/
> Ignorance continues to thrive when intelligent people choose to do
> nothing.  Speaking out against censorship and ignorance is the imperative
> of all intelligent people.