HTTP“会话”重建如何工作？

Question

I have found this tool online: http://www.unleashnetworks.com/products/unsniff.html

How does this work? Are they assuming that all HTTP traffic for a session occurs in the same TCP session, and then just clumping all that data together? Is that a safe assumption?

I was under the impression that when I load a page, multiple TCP sessions could be running for that single page load (images, videos, flash, whatever).

This seems to get complicated when I think about having two browser tabs open that are loading pages at the same time..how could I differentiate one http "session" from another? Especially true if they are hitting the same page, right?

For that matter, how does the browser know which data incoming belongs to which tab? Does it keep track of TCP sessions belonging to an individual tab?

Edit:

When HTTP session is mentioned above, I am referring to all of the related HTTP transactions that it takes to, say, load a page.

By TCP session, I am literally referring to the handshake's SYN -> FIN packet lifetime.

Answer 1

Although it might not be visible, the HTTP Session tracker is being passed to the server from the client as a parameter or as e cookie (header)

You might need to read about HTTP session token

A session token is a unique identifier that is generated and sent from a server to a client to identify the current interaction session. The client usually stores and sends the token as an HTTP cookie and/or sends it as a parameter in GET or POST queries. The reason to use session tokens is that the client only has to handle the identifier—all session data is stored on the server (usually in a database, to which the client does not have direct access) linked to that identifier. Examples of the names that some programming languages use when naming their HTTP cookie include JSESSIONID (JSP), PHPSESSID (PHP), and ASPSESSIONID (ASP).

Answer 2

I am not familiar with the "Unsniff" app you link to, but I have used a few packet sniffers before (my favorite is Wireshark ). Usually you can differentiate sessions based on what host they are connected to. So, for instance, if you have 2 tabs open and one is opened to www.google.com and the other is www.facebook.com, the packet sniffer should be able to tell you which session is pointed at which host (or at least give you an IP address, which you can then use to find the host. see: reverse lookup ).

Most times, multiple HTTP sessions will be open to one host. This is the case when you're loading a site's various resources (CSS files, images, javascript, etc.). Each of these resources will show up as a separate HTTP session (unless, of course, the connection is persistent ... but your sniffer should be able to separate them anyway). In this case, you (or the sniffer) will need to determine what was downloaded by looking at the actual data within the HTTP packet.