Which option helps determine the actual HTTP response size when the header does not show Content-Length?

Study for the Wireshark Block 5 Exam. Prepare with flashcards and multiple choice questions, each offering hints and explanations. Ace your exam with the best resources!

Multiple Choice

Which option helps determine the actual HTTP response size when the header does not show Content-Length?

Explanation:
When the Content-Length header isn’t present, you can still determine the actual HTTP response size by looking at how the body is carried over the connection. If the server uses chunked transfer encoding, the body is sent in chunks, each preceded by its size in hexadecimal. The sequence ends with a zero-length chunk. Decoding these chunks (or using a tool that does) lets you sum the sizes to get the total body length. Another reliable method is to reconstruct the entire HTTP conversation with a feature like Follow HTTP Stream. This reassembles the bytes from the TCP stream into the complete HTTP response, so you can see and measure exactly how much data was delivered in the body. The other options don’t directly reveal the HTTP body size. DNS ID and TTL relate to domain name resolution, not the HTTP payload. IP fragmentation deals with how packets are split across the network and doesn’t by itself provide a straightforward total body length. TCP window size affects transmission flow control, not the total amount of data in the HTTP response.

When the Content-Length header isn’t present, you can still determine the actual HTTP response size by looking at how the body is carried over the connection. If the server uses chunked transfer encoding, the body is sent in chunks, each preceded by its size in hexadecimal. The sequence ends with a zero-length chunk. Decoding these chunks (or using a tool that does) lets you sum the sizes to get the total body length.

Another reliable method is to reconstruct the entire HTTP conversation with a feature like Follow HTTP Stream. This reassembles the bytes from the TCP stream into the complete HTTP response, so you can see and measure exactly how much data was delivered in the body.

The other options don’t directly reveal the HTTP body size. DNS ID and TTL relate to domain name resolution, not the HTTP payload. IP fragmentation deals with how packets are split across the network and doesn’t by itself provide a straightforward total body length. TCP window size affects transmission flow control, not the total amount of data in the HTTP response.

Subscribe

Get the latest from Passetra

You can unsubscribe at any time. Read our privacy policy