HTTP Content length less than File byte-size, did it fully download? -
trying determine if user downloaded executable file website. examined pcap , see content-length field = 784,536 server->user 430,380 bytes. tells me user did not download file. downloaded file myself , see 766 kb. possible content-length value based on http header not equal file size of exe file if downloaded (the local file size)? correct?
packet capture data (i can't post screenshots)
get /chromaslite211setup.exe http/1.1 host: www.technelysium.com.au user-agent: mozilla/5.0 (windows nt 5.1; rv:17.0) firefox/17.0 accept: text/html, application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 accept-language: en-us accept-enconding: gzip, deflate connection: keep-alive referrer: http://technelysium.com.au/ http/1.1 200 ok date: thu, 01 aug 2013 17:28:17 gmt server: apache last-modified: mon, 15 apr 2013 08:29:57 gmt accept-ranges: bytes content-length: 784536 keep-alive: timeout=5, max=100 connection: keep-alive content-type: application/x-msdownload mzp........................@.............................!..l..this program must run under win32 entire conversation (430722 bytes) users ip -> server ip (342 bytes) server ip -> users ip (430380)
when download file site shows as, "binary file (766 kb)"
converting bytes kilobytes
784,536/1024 = 766.14
Comments
Post a Comment