

Note that if these are actually two requests within the same connection then these are very strange behaving HTTP client and server or no (proper) HTTP at all. to find out if there was a connection teardown (FIN) and setup (SYN) for the same endpoints between the requests. The timing information shown suggest that these requests are close together.īut, it is impossible to be definite about this without seeing more parts of the connection, i.e.


The first request has a (relative) start sequence of 1 with a length of 9 and the second seems to immediately follow this by having a start sequence of 10.Usually the source port if ephemeral and does not get reused quickly for another connection. source port, source IP, destination port and destination IP for both requests are exactly the same. It is likely that these are two requests in the same connection because:
