Network Behavior of a Web Server

Like other protocols, HTTP is layered above the TCP/IP stack. The following shows this layering, using the same ISO model from Chapter 16, "File and Print Servers."

ISO Layering Model
Application	HTTP
Presentation
Session
Transport	TCP
Network	IP
Data link	IEEE 802.3
Physical	Ethernet

Using the Ethereal packet-capture tool discussed in Chapter 16, we can see the individual requests and responses from the "Protocol Layering" section of Chapter 16. Figure 15-1 shows the packet exchange used in that example.

Figure 15-1. Sample packet exchanges captured by the Ethereal tool.

The first three packets illustrate the TCP three-way handshake used to establish a connection to the web server. The fourth packet contains the HTTP request from the client, and the sixth contains the response header with the 200 OK message. The remaining packets are mostly either data packets containing the body of the HTTP response (packets from the server to the client) or the TCP acknowledgments for that data (packets from the client to the server). The final four packets are the four-way handshake used to shut down the connection (the first FIN from the server is packet number 30; the FIN bit is not visible in the figure but it is there if you expand the view of the packet).

Figure 15-2 illustrates one packet in detail.

Figure 15-2. Detail of one packet exchange captured by the Ethereal tool.

Zooming in on packet 8, which contains the HTTP response headers from the server, we see that this is an HTTP packet encapsulated on top of TCP, which in turn is embedded in an IP packet, which itself is the payload of an Ethernet packet.