Wireshark Lab #3 - The HTTP CONDITIONAL GET/response interaction

HTTP, Browser Caching, And Conditional Get
Most web browsers perform object caching and thus perform a conditional GET when retrieving an HTTP object. Before performing the steps below, make sure your browser’s cache is empty. (To do this under Firefox, select Tools->Clear Recent History and check the Cache box, or for Internet Explorer, select Tools->Internet Options->Delete File; these actions will remove cached files from your browser’s cache.) Now do the following:

• Start up your web browser, and make sure your browser’s cache is cleared, as discussed above
• Start up the Wireshark packet sniffer
• Enter the following URL into your browser
• http://www.steamclown.org//cyberSecuritySVCTE/wireshark/wireshark_lab_003.htm
• Your browser should display a very simple five-line HTML file.
• Quickly enter the same URL into your browser again (or simply select the refresh button on your browser)
• Stop Wireshark packet capture, and enter “http” in the display-filter-specification window, so that only captured HTTP messages will be displayed later in the packet-listing window

Answer the following questions:

1. Inspect the contents of the first HTTP GET request from your browser to the server. Do you see an “IF-MODIFIED-SINCE” line in the HTTP GET?
2. Inspect the contents of the server response. Did the server explicitly return the contents of the file? How can you tell?
3. Now inspect the contents of the second HTTP GET request from your browser to the server. Do you see an “IF-MODIFIED-SINCE:” line in the HTTP GET? If so, what information follows the “IF-MODIFIED-SINCE:” header?
4. What is the HTTP status code and phrase returned from the server in response to this second HTTP GET? Did the server explicitly return the contents of the file? Explain.

 Turn in to Jupiter as a PDF