How would you reassemble chunked HTTP responses in Wireshark?

• A. Ensure HTTP reassembly is enabled and use Follow TCP Stream to view the complete content
• B. Use the HTTP analyzer to convert chunked responses into single messages
• C. Enable TLS decryption to see the content
• D. Manually concatenate TCP segments outside Wireshark

Answer: (A)

Chunked HTTP responses are sent as multiple chunks over the same TCP connection, so you need the tool to stitch those pieces back together to see the full message. If HTTP reassembly is enabled, Wireshark can reconstruct the entire HTTP payload from the individual TCP segments. Using Follow TCP Stream then presents the complete, in-order content as it appeared on the wire, including headers and body, which is exactly what you want when you’re analyzing a chunked response.

The other options aren’t the right fit here: there isn’t a separate HTTP analyzer that magically converts chunked pieces into one message in Wireshark, and TLS encryption would prevent you from seeing the content unless you decrypt it first. Manually concatenating segments outside Wireshark defeats the built-in reassembly and is unnecessary.