SharkFest ‘16
Wireshark 2.0 Tips for HTTP 1/2 Analysis:
Goodies about New Wireshark and Packet
Analysis for HTTP
Megumi Takeshita
Packet Otaku | ikeriri network service co.,ltd
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Megumi Takeshita, ikeriri network service
a.k.a. packet otaku since first Sharkfest
•
•
•
•
•

Founder, ikeriri network service co.,ltd
Wrote 10+ books of Wireshark and capturing
and network analysis.
Reseller of Riverbed Technology ( former
CACE technologies ) and Metageek,
Dualcomm etc. in Japan
Attending all Sharkfest 9 times
and translator of QT Wireshark into
Japanese

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

21 Wireshark 2.0 Tips for HTTP 1/2 Analysis:
Goodies about New Wireshark and Packet
Analysis for HTTP
•This session contains TIPS and TRICKs
for HTTP 1 / 2 using Wireshark 2.0,
and also includes HTTP and HTTP2 analysis
for packet analysis beginners.
•Limited English skills,
so please ask me if you have some question.

SharkFest ‘16 • Computer History Museum • June 13-16, 20163

sample trace files in the session you can download
Download: http://www.ikeriri.ne.jp/wireshark/traces/

At first, open the homepage.pcap
The trace file is just open the simple website
http://www.ikeriri.ne.jp/sample.html
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

TIPS #1 first, check arrows and colors of the frame
and the intelligent scroll bar•New Wireshark tell you traffic with arrow and color of thescroll bar. It tells us the traffic
DNS

TCP

Color of the scroll bar

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

TIPS #2 Generated fields and links tell us theimportant information•There are two kinds of fields in Wireshark header,
the actual field like Web Server ( http.server) in HTTP header,
the generated field ( easily to find [ generated field name ] ) that
Wireshark created for understanding the packet.
Some generated fields have a link to jump the corresponding frame.
Actual header ( HTTP Server field )Generated field (Wireshark counts response number (http.response_number) )Generated field (Wireshark calculate http response time (http.time) )Generated field and Link ( Wireshark set link to the http request frame)

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

We can use generated fields as actual fields inGenerated Fields can be used
I/O graph, display filter, etc.
as the index of the I/O Graph,
Display filter string and the otherof Wireshark.
For example, there are twogenerated fields, http.time (Wireshark calculates time
between HTTP request andresponse ) and dns.time(between DNS query andresponse )so you can easily compare theweb speed (blue bar ) versus
dns speed ( red bar )SharkFest ‘16 • Computer History Museum • June 13-16, 2016

TIPS #3 HTTP statistics tell us the scale and theTURN(LOOP) of the whole Web traffic.
•HTTP statistics contains important
information of HTTP trends•Packet counter shows HTTP packets
by the request method and by the
response code, and shows subtotal of
the each method and code in details. so
we can grab the scale and the TURNsof the certain web traffic,

Request/Response Counts

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HTTP/1.1 TURN=Request Response Loop
HTTP Request
GET /sample.html HTTP/1.1
Web
Browser

HTTP Response
HTTP/1.1 200 OK
Connection: keep-alive

Web
Server• HTTP/1.1 has a Connection header,Server response with Connection: keep-alive
so you can re-use the same connection.
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Bulk transfer vs interactive access of webpage
Bulk transfer runs
faster thaninteractive design
website.
Just think of
RTT x TURNs

Bulk transfer webpage

Interactive access webpage

ClientClientR
T
T

ServerRequest1
Response1(TCP1/3)
Response1(TCP2/3)
Response1(TCP3/3)

Get one image map fileusing HTTP 1.1 ( 1 request

R
T
T
R
T
T

ServerRequest1
Response1
Request2

Response2
Request3
Response3

Get some Small icon file(icon1.jpg, icon2.jpg ) using
HTTP 1.1

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Test trace file: PrimeMinisterJapan.pcapng
Next please open the another trace file
PrimeMinisterJapan.pcapng
the trace file contains HTTP1.1
packets the user open the website
http://www.kantei.go.jp

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Compare Counts and grab the efficiency andspeed and scale of webpage
ikeriri.pcapng
http://www.ikeriri.ne.jp/

19 Request GETLess Requests
Less Response
Less TURNs * RTT
Simple homepage

23 Response
19 Response 200 OK
1 404 Client Error
3 2xx Redirection

PrimeMinisterJapan.pca
png
http://www.kantei.go.jp/

144 Request GET
144 Response
2 Redirection
142 Response 200 OK

More Requests
More Response
More TURNs * RTT
Complicated homepage
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Sort the HTTP counts
by Percent tells us the ratio of request/response,by Rate(ms) tells us the slow point (3xx redirect),by Burst rate tells us the congestion point of traffic
Burst = themaximum number ofpackets sent perinterval of time
Burst start = thetime when the
maximum number ofpackets sent
occurred
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

TIPS #4 Export Objects function is useful in retrieving
Web contents from packet (not from cache).
•If you want to get the original
web content from the packet,
you use “export Objects > HTTP”
from file menu.
•Wireshark made lists of web
contents with packet number,host name, content type, sizeand file name.
•You can save them all or each.
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Sort the objects by the size, you know which contents
need the transfer time.
•“export Objects > HTTP”
from file menu and save
all to the temporal folder.
•Sort the objects in
explorer by size, andcheck which one is thebiggest.
•Some HTTP uses
compression mechanism
so sometimes actual“20130128headline..” JPEG file 95kb and“Jquery-1.7.1.min.js” Java script 95kb take times.

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

TIPS #5 to understand HTTP request andresponse loop, use the “follow TCP stream”•“Follow TCP Stream” function sorts TCP stream from bothclient and server side, so we can look a series of HTTP
communication at a glance•Follow TCP Stream is just a simple.
select TCP packet ( any frame
you want to look into the socket )and right clik then select“Follow TCP Stream”

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HTTP/1.1 message format
MethodHTTP Request

GET / HTTP/1.1
User-Agent: Safari
Host: www.ikeriri.ne.jp
Accept: */*CR+LF

HTTP Response Status CodeHTTP/1.1 200 OK
Content-Length: 44
Content-Type: text/html<html><body><h1>Sample</h1></body></html>

CR/LF separates between HTTP
header and body ( two CR/LF appears.)
SharkFest ‘16 • Computer History Museum • June 13-16, 2016 17

if you failed to select the target stream, no problem,
press up and down to select the stream forward
and backward in the follow
TCP/UDP/SSL screen.

input stream number or press up or
down arrow to serlect the stream
Wireshark set the number of
stream as generated field,
we can handle the stream as
tcp.stream, udp.stream, ssl.stream
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

How to grab Follow TCP Stream
Select HTTP headers
between beginning andblank CR/LF
HTTP response usually has
the body, selectfrom fisrt blank to the end.

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

TIPS #6 memorize major request method
MethodCONNECT
DELETEGETHEAD
OPTIONS
POST
PUT
TRACE

Mean
Tunneling the other tcp connection over HTTP
Deleting Objects ( used by WebDAV )
Give
me
the
content
with
some
order
( ?para1=val1&para2=val2&…)
Not secure than POST because the URI and message are
combined and recorded by Referrer header.
Usually order message is small and not important.
Give me only the HEADER of the content
Check the method web server accepts.
Sending information with body ( secure )Message send as the body part of the request.
Post message is secure and able to send much data
Uploading Objects ( used by WebDAV )Check proxy sever by displaying request message,
Used with “Max-Forwards” header

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

You can test the method by telnet client with port 80• You can test the methods bytelnet with TCP port 80• Recommend “set localecho”
because your typing is directlysent and not displayed. And you
cannot modify the typing.
• Blank line needs two Enter key
pressing ( CR/LF, and blank
CR/LF )• Example: OPTIONS * HTTP/1.0• Sometimes web server is not
accepted because security reason.
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

TIPS #7 memorize major response code
•Response code is important for the understanding the HTTP response•Response codes are 3 digits and categorized by the hundred number
digit, so you may memorize 5 types of the response.
Code
1xx
2xx
3xx

type
Information
Success
Redirection

4xx
5xx

Client error
Server error

Description
Temporal information for the client web browserYour request is OK. I send the response.
The object was moved., I tell you new address withthe location header,so please send the request again with new URIYour error caused from web browser
My error caused from web server

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Famous response code (1xx)
code
100
101

messageContinue

description
You can continue to send the rest of the request.
( Large data request )S w i t c h i n g Web browser send request with “Upgrade:” header
Protocols
Then Web server answers OK to switch protocol.
( Used by starting process of HTTP/2.0 connection )SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Famous response code (2xx)
code
200
201
202

203
204
205
206

message

説明

OK
CreatedOK, I send the response.
I created the content. ( send back to PUT method andused by WebDAV)
Accepted
Accepted, please continue the rest, ( usually accepted
PUT method )Non Authoritative I received your request, but I have no authority of theInformation
content. ( Proxy server says )No Content
I received your request, but there are no content.
Reset Content
Please reset the content ( used with input form of web
page )
Partial Content
I send the partial content for your partial get method

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Famous response code (3xx)
Code
３００

Message
Multiple Content

Description
The contents locates in many other places. Web server says
the list of the locations.
The content was moved and please go to the new URI with
Location header

３０１

Moved Permamently

３０２

Found

The URI is ok but please go to the new address with
Location header.

３０４

Not Modified

The content is not modified so you don’t have to get thecontent, you may use the cache of the web browser.

３０５
３０７

Use ProxyTemporary Redirect

Please use the specified proxy server.
The content was located in another URI temporally, so
please go to the new URI with Location header.

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Famous response code (4xx)
CodeMessage400
Bad Request
401
403
404
405
407
411
413
414

Description
The request message from the web browser is not corrected orwrong, sometimes it occurs when the web server is attacked.
Unauthorized
You need the authentication with basic auth or digest auth.
web browser show up the authentication screen.
Forbidden
Authentication was failed.
Not Found
The web page is not found.
Method Not Allowed
The method the client browser sent is not permitted.
P r o x y A u t h e n t i c a t i o n You need proxy server authentication.
RequredLength Required
You need to send request with Content-Length header
Request Entity Too Large The size of request is exceeded. It occurs POST message is
too large.
Request URI Too LongThe URI is too long to accept. It occurs the length of the GET
request is oversize
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Famous response code (5xx)
Code
500

message
Internal Server Error

501
502

Not Implemented
Bad Gateway

503

Service Unavailale

Description
Web server cannot respond to the client browser
because server side problem ( such as Java, CGI, PHP ).
The method client sent is not implemented.
Proxy server receives the error from the origin server oranother relay proxy.
Web server could not process the request message,
commonly it happens when web server is heavy load,
tons of access or high stress.

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Example1
homepage.pcapng
Access the website
http://www.ikeriri.ne.jp/
sample.html
HTTP request
GET /sample.html HTTP/1.1
HTTP response
HTTP/1.1 200 OK
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Example2
whitehouse.pcapng
Access the website
http://www.whitehouse.gov/
HTTP request
GET / HTTP/1.1
HTTP response
HTTP/1.1 302 Moved Temporally
to change HTTPS

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Example3
basicauth.pcapng
Access the website
http://www.ikeriri.ne.jp/basicauth/
HTTP request/response(1)GET /basicauth HTTP/1.1
HTTP/1.1 401 Authorization Required(2)GET /basicauth HTTP/1.1
HTTP/1.1 301 Moved Permanently(3)GET /basicauth/ HTTP/1.1
HTTP/1.1 200 OK
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

TIPS #8 tons of HTTP headers so Wireshark helps us•There are tons of HTTP headers so you cannot memorize them.
•Wireshark helps us understanding HTTP header.
•Select one of HTTP header and look the status bar•Explanation of the header and display filter will be displayed.
•Some HTTP header
is used only in request( request header )•Some only in response( response header )•Some is used for end-to-end( browser to server )•Some is used for hop-by-hop( proxy to proxy and so on )SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Easy to memorize the header symmetric ways
HTTP Request
User-AgentWeb browser information
http.user_agent
CookieSend the information
http.cookie
Referrer
The past URI
http.referer

HTTP Response
ServerWeb server information
http.server
Set-Cookie
Set the information
http.set_cookie
Location
The new URI
http.location

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

TIPS #9 HTTP/2.0 has already come•HTTP/1.0 is just designed for simple HTML text and a few
graphic in 1990’s, HTTP/1.1 added connection features.
•Now HTTP is so popular, sending rich data and the basisof many services.
HTTP’s Request-response based connection is simple but
difficult to speed up, so we have to multiplex many TCP
sessions = HTTP
• sessions ( 4-6
sessions
for example)
HTTP
RequestHTTP Request
HTTP
Request
Web
Web
HTTP
Request
Web
Web
HTTP
RequestWeb
Web
ServerBrowser
HTTP
Response
Web
Web
ServerBrowser
HTTP
Response
HTTP
Response
Web
Web
ServerBrowser
HTTP
Response
HTTP
Response
HTTP
Response
ServerBrowser
HTTP
Response
HTTP
Response
ServerBrowser HTTP
Response
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Test downloading 4-6 files at same time using HTTP

• Please click 4-6 files download link using your browser
such as IE, Chrome, or Safari.
( for example http://www.ikeriri.ne.jp/download/wireshark/developer-guide-a4.pdf)• Web browser stop downloading when 4-6 sessions at thesame time.
• Please Check sessions

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HTTP/1.1 is difficult to speed up
ClientServerRequest1
Response1
Request2
Response2

Request3
Response3•HTTP request have to send after
previous response has been received.
•Please input display filter in Wireshark“http.next_request_in” ( Next request inframe in HTTP request)•HTTP request is always waiting in one
connection. ( head line blocking)

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HTTP/1.1 is text based, not efficient protocol•HTTP is text-based application protocol, easy to read,but not efficient, ambiguous, and redundant•HTTP messages are clear texts so they uses more data
and CPU power for dissection.
•Many connection is separated by each other TCP
connection, they work their own TCP rules without HTTP.
GET / HTTP/1.1
User-Agent: Safari
Host: www.ikeriri.ne.jp
Accept: */*HTTP/1.1 200 OK
Content-Length: 44
Content-Type: text/html<html><body><h1>Sample</h1></body></html>

CR+LF
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HTTP/1.1 -> AJAX -> SPDY -> HTTP/2.0• AJAX（ Asynchronous JavaScript + XML ）is one of good ways tospeed up HTTP. AJAX preload another contents using JavaScript,
and enrich user experiences.
• Google creates SPDY that extends HTTP/1.1 ( SPDY uses same
method, response code, header and message of HTTP/1.1)• SPDY uses binary frame such as lower layer frame, and once someheader appears, next time SPDY uses index instead of the header
itself, SPDY uses table based code ( table-based header
compression )• SPDY uses stream mechanism for multiplexing, there are many
HTTP communications in one TCP connection• SPDY is evolved and known as HTTP/2.0 (RFC7540)
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HTTP/2.0 has already come•In Windows10 age, major Web browser and websites suchas google services including Google Map and Gmail,
Facebook, Twitter, Yahoo and web services are ready.
•HTTP/2.0 uses with TLS and all traffic is encrypted.
•Please run the Chrome, Microsoft Edge, Safari andcapture major webpage, HTTP2 has already been here.

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Please open the test website HTTP/2.0 vs HTTP/1.1
http://http2.loadimpact.com/entry/

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Please open the test website HTTPS vs HTTP
https://www.httpvshttps.com/
Compare load times of the unsecure HTTP and encrypted HTTPS versions of this page. Each test
loads 360 unique, non-cached images (0.62 MB total). For fastest results, run each test 2-3 times in a
private/incognito browsing session.

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HTTP/2.0 uses SSL/TLS so difficult to decode• HTTP/2.0 works on SSL/TLS
connection in general.
• Decoding HTTP/2.0 is difficult toread, sometimes you need theproxy in the middle.
• Open the Chrome and type
chrome://net-internals/#http2you can see the HTTP/2
sessions• Wireshark has the dissector of
HTTP2.0 (http2)
https://www.wireshark.org/docs/
dfref/h/http2SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Sample trace file:akamai-demo.pcapng with ssl.key• HTTP2 packet is always encrypted to
SSL, so this time we use the sample
of akamai-demo.pcapng with ssl.key
file that describes the pre-mastersecret key with SSL session ID.
• So please open the packet,
and select SSL layer and right click,to choose the protocol preferences.
And set (pre)-Master-secret log fileusing Browse button to set ssl.key• Client web browser: 192.168.0.192
Web server: 23.78.84.108
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HTTP2.0 binary frame( fixed header field, size and position of each fields )SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HTTP2.0 binary frame （RFC7540)( fixed header field, size and position of each fields )+-----------------------------------------------+|
Length (24)|+---------------+---------------+---------------+|
Type (8)|Flags (8)|+-+-------------+---------------+-------------------------------+|R|
Stream Identifier (31)|+=+=============================================================+|
Frame Payload (0...)...
+---------------------------------------------------------------+

maximum payload 16383 octets
Length : Payload SizeType
: Type of Frame
Flags : for example END_STREAM END_HEADERS
Stream Identifier : 0-Management Odd-Client Even-Server(each connection ) incremental use the id
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Major HTTP/2.0 frame type (http2.type)Type

Description

http2.type

DATA

HTTP/2.0 data

0x0

HEADERSHTTP/2.0 header

0x1

PRIORITY

Stream priority

0x2

RST_STREAM

Reset stream

0x3

SETTINGS

Connection Setting information

0x4

PUSH_PROMISE

Server push

0x5

PING

Ping

0x6

GOAWAY

Finish connection

0x7

WINDOW_UPDATE

Update window ( receive buffer )0x8

CONTINUATION

Continue information

0x9

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HTTP/2.0 Statistics

Wireshark has statistic feature of HTTP2
Select Statistics -> HTTP2
Wireshark collect all HTTP2 frames and divided
by each Type of the frames, and list up withcount, Rate(ms), Burst rate, and Burst start time
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

SETTING frame （RFC7540)+-------------------------------+|
Identifier (16)|+-------------------------------+-------------------------------+|
Value (32)|+---------------------------------------------------------------+SETTING is used in setting up the HTTP 2 connection
by both client and server
Identifier is Stream no and is set as 0
SETTING frame needs ACK
To reply the setting frame, use ACK flag
And setting connection information such as
SETTINGS_HEADER_TABLE_SIZE
SETTINGS_ENABLE_PUSH
SETTINGS_MAX_CONCURRENT_STREAMSSETTINGS_INITIAL_WINDOW_SIZE
SETTINGS_COMPRESS_DATA
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HEADER frame （RFC7540)+---------------+|Pad Length? (8)|+-+-------------+-----------------------------------------------+|E|
Stream Dependency? (31)|+-+-------------+-----------------------------------------------+| Weight? (8) |+-+-------------+-----------------------------------------------+|Header Block Fragment (*)...
+---------------------------------------------------------------+|
Padding (*)...
+---------------------------------------------------------------+HEADER frame is used to tell HTTP2 Header information.
Stream Dependency and weight is used to assign stream index and priority.
Header Block Fragment contains HTTP2 header
HTTP2 Header is table based compressed (HPACK) and set as index no.
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

DATA frame （RFC7540)+---------------+|Pad Length? (8)|+---------------+-----------------------------------------------+|
Data (*)...
+---------------------------------------------------------------+|
Padding (*)...
+---------------------------------------------------------------+DATA frame contains actual HTTP2 data ( HTTP2 body )Actual HTTP data stores in Data field ( http2.data.data )SharkFest ‘16 • Computer History Museum • June 13-16, 2016

RST_Stream frame（RFC7540)+---------------------------------------------------------------+|
Error Code (32)|+---------------------------------------------------------------+

RST_STREAM frame is used when the user want to stop andreset http2 stream immediately.
RST_STREAM frame type is 3
Error code contains the reason of resetting stream

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HTTP/2.0 manages communications using Stream mechanism
HTTP/2.0 uses 1 tcp connection and many Stream ( virtualconnection channel ) that has id and priority
1 tcp connection used by HTTP/2.0
HTTP/2.0 request

WebbrowserStream(id 1)

Binary frame
Binary frame

HTTP/2.0 response
HTTP/2.0 request
Stream(id 2)

serverBinary frame
Binary frame

HTTP/2.0 response
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Stream based connection management of HTTP/2.0= TCP based connection management of HTTP/1.1+--------+
send PP || recv PP,--------| idle |--------.
/
|
|
¥
v
+--------+v+----------+|+----------+||| send H / ||,------| reserved || recv H| reserved |------.
|| (local) ||| (remote) |||+----------+v+----------+|||+--------+||||
recv ES || send ES|||
send H |,-------| open |-------.
| recv H
|
|
|
/
|
|
¥
|
|
|
v
v
+--------+v
v||+----------+|+----------+
|
|
|
half
|
|
|
half
|
|
|
| closed || send R / | closed |||| (remote) || recv R| (local) |||+----------+|+----------+
|
|
|
|
|
|
|
| send ES /|recv ES / |||| send R /vsend R / |||| recv R+--------+
recv R||| send R / `----------->||<-----------' send R / || recv R| closed |recv R|`----------------------->||<----------------------'+--------+

send: endpoint sends this frame recv:
endpoint receives this frame
H: HEADERS frame
PP: PUSH_PROMISE frame
ES: END_STREAM flag
R: RST_STREAM frame• Stream mechanism is very
similar to TCP• HTTP2 Stream have state chart
diagrams like TCP• Start from idle, connect inopen state, ES(End_Stream)and end in closed state

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Flows of HTTP2 connectioni.

Connect TLS connection between
client and server (with ALPN todetermine protocol and version of
HTTP2)
ii. Server sends SETTINGS andWINDOW_UPDATE frameiii. Client sends Magic, SETTINGS,WINDOW_UPDATE
iv. Client sends HEADERS,
WINDOW_UPDATE
v. Client sends SETTINGS
vi. Server sends SETTINGS
vii. Server sends HEADER, DATA, DATA
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

(i) ALPN Application Layer Protocol Negotiation
1. The user use the URL as https://...
and start up TLS connection
2. When client sends “Client Hello” in
TLS connection, client sends
ALPN information with the list of
protocols client want to use
3. Server respond with “Server Hello”
with ALPN information server
determined to use HTTP2 draft14

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Another way to start up HTTP2 connection
HTTP Upgrade (RFC7540)
1. The user the URL as “http://...” and start up HTTP/1.1 connection
2. HTTP request contains “Upgrade” and “HTTP2-Settings” header
GET / HTTP/1.1
Host: server.example.com
Connection: Upgrade, HTTP2-Settings
Upgrade: h2c
HTTP2-Settings: <base64url encoding of HTTP/2 SETTINGS payload>

3. Server respond with 101 status code
HTTP/1.1 101 Switching Protocols
Connection: UpgradeUpgrade: h2c[ HTTP/2 connection ...
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

(ii) Server sends SETTINGS and WINDOW_UPDATE frame
After finishing TLS connection
with ALPN to determine protocol
and version of HTTP2
Server sends SETTINGS andWINDOW_UPDATE frame
SETTING frame contains
Max concurrent stream
Initial Windows size
Max header list size
WINDOW_UPDATE frame contains
Window Size Increment

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

(iii) Client sends Magic, SETTINGS, WINDOW_UPDATE frame
Client sends Magic, SETTINGS,WINDOW_UPDATE frame
Magic frame contains“PRI * HTTP/2.0 CR+LF
CR+LF
SM
CR+LF, CR+LF
SETTING frame contains
Initial Windows size
Max frame size
WINDOW_UPDATE frame contains
Window Size Increment

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

(iv) Client sends HEADERS, WINDOW_UPDATE frame
Client sends HEADERS,
WINDOW_UPDATE frame
HEADERS frame contains
HTTP2.0 header information
WINDOW_UPDATE frame contains
Window Size Increment

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HEADERS frame• method
HTTP method• pathPath of the object• authority
Host of the server• scheme
HTTP / HTTPS• user-agent:browser information

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HPACK ( table based Header compression )

•
•
•
•
•

HTTP/2.0 doesn’t use the String, but just send the value.
HPACK uses Huffman encoding,
HPACK uses static table index that defined common headers.
HPACK uses header table index that used for history of sent header/value.
HPACK uses reference set that used for sending the difference from last header.
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

(v) Client sends SETTINGS frame
Client sends SETTINGS
frame
SETTINGS frame
contains ACK to theserver’s SETTINGS
frame

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

(vi) Server sends SETTINGS frame
Server sends SETTINGS
frame
SETTINGS frame
contains ACK to theclient’s SETTINGS frame

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

(vii) Server sends HEADER, DATA, DATA
Server sends HEADER, DATA, DATAFrame
HEADERS frame contains
HTTP2.0 header information
DATA frame contains
HTTP2.0 DATA (body)

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HTTP/2.0 response
HEADERS• :status
Status code
• serverweb server• content-type
document type

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

HTTP/2.0 response
DATA
Actual body part of
HTTP/2.0 storesin Data fieldof DATA frame(http2.data.data)

SharkFest ‘16 • Computer History Museum • June 13-16, 2016

TIPS #10 USE Wireshark for future protocols.
• HTTP/2.0 also has Server Push feature.
Client does not have to send request• HTTP/3.0 is now developing.
• Google creates QUIC ( Quic UDP Internet Connections)
QUIC behaves as TCP/TLS over UDP layer
QUIC is used in Google services now, and Wireshark also
• Oh all protocols are invisible andwe are going to the dark age of bender specific unknown
protocols by giant venders…
• Don’t worry, Wireshark decodes everything.
• Wireshark is the light for future protocols to the future.
SharkFest ‘16 • Computer History Museum • June 13-16, 2016

Thank you very much for your listening

Use Wireshark for ever !
Thank you !
どうもありがとうございます！

SharkFest ‘16 • Computer History Museum • June 13-16, 2016