PCAP 23

In this lab, participants will download a provided PCAP file and use Wireshark to analyze the network traffic. The file contains two HTTP requests and corresponding responses, all utilizing the same TCP connection with the "Connection: keep-alive" header. By following the TCP stream in Wireshark, users can reconstruct the entire session and extract the key parameter from the second request.

The exercise demonstrates the efficiency of the "Connection: keep-alive" feature in HTTP, which allows multiple requests and responses to be sent over a single TCP connection. This reduces the overhead of establishing new connections and improves overall performance. The key goal is to familiarize users with TCP stream reconstruction and the practical benefits of persistent connections.