# QDPF/TRACE # John Hawksley - john@bawue.de - http://www.hawksley.net/software/qdpf # # SAMPLE PROTOCOL TRACE FILE # This file is a sample protocol trace of the entire session between # a desktop web browser and the web server at The Armory (www.armory.com). # # The forwarder was run on a Linux firewall (gazunda), and a client IE 6.0 # browser was run on godzilla (my desktop) # # HASHED LINES ARE MY ANALYSIS, everything else came from QDPF # # Command line used for this session: # java pf 8080 80 www.armory.com trace # # URL used from client: # http://gazunda:8080/ # QDPF says hello. QDPF Version 1.04 - John Hawksley - john@bawue.de http://www.hawksley.net # When all listeners are created and running: QDPF: Listening for new connections. # Since this is the first transaction, QDPF reports the socket open: CONNECTION ACCEPT: from Socket[addr=gazunda.intra.net/192.168.0.1,port=1126,localport=8080] # Transaction 1: the client asks for the root document, with KEEPALIVE, so the # socket is not closed by either end after the delivery of the document. # The <--] marker here clearly shows the blank line indicating end-of-headers. # There is no body. **************************************** CLIENT -> SERVER **************************************** GET / HTTP/1.0 Accept: */* Accept-Language: en-us Pragma: no-cache User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90) Host: gazunda:8080 Via: 1.0 gazunda.intra.net:3128 (Squid/2.2.STABLE3) X-Forwarded-For: 192.168.0.2 Cache-Control: max-age=259200 Connection: keep-alive <--] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # Transaction 2: the server says 200 OK and returns the document, # notice that it has accepted the keep-alive. **************************************** SERVER -> CLIENT **************************************** HTTP/1.0 200 OK Last-Modified: Sat, 04 Aug 2001 06:27:12 GMT Server: Roxen/2.1.265 Content-Length: 1522 Connection: keep-alive Accept-Ranges: bytes Content-Type: text/html The Armory

Welcome to The Armory!

"since 1989"
We use the Roxen web server. Please let us know if anything goes wrong.
Lynx Friendly! The Armory's web space is best viewed with... any browser.
This web page maintained by John DuBois
This site has received appro<--] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # Transaction 2: remainder data for previous packet. # # The previous packet was completely filled by the reply, so another packet is # being sent with the remainder. # NB - the split was not at the protocl layer, rather it was at the network # layer, so the headers are not resent. **************************************** SERVER -> CLIENT **************************************** ximately 61 million accesses since 1994.
Key Resource
Links2Go
Santa Cruz <--] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ #... etc. etc. ...