LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > General
User Name
Password
General This forum is for non-technical general discussion which can include both Linux and non-Linux topics. Have fun!

Notices


Reply
  Search this Thread
Old 06-22-2010, 07:40 AM   #1
deostroll
Member
 
Registered: Aug 2007
Location: Bangalore
Distribution: fedora
Posts: 113

Rep: Reputation: 15
how does a browser put traffic on the network?


This curiosity started with port 80. I know that a web server program listens to port 80 where most http traffic comes into the system. (This setting is by default). Even browsers sends/receives http traffic if I am not mistaken. So shouldn't they technically use port 80 for communicating?

If this is the case if you have both a web server and a browser program, how does the browser only receive traffic/data corresponding to the requests it has created...?
 
Old 06-22-2010, 08:34 AM   #2
AlucardZero
Senior Member
 
Registered: May 2006
Location: USA
Distribution: Debian
Posts: 4,824

Rep: Reputation: 615Reputation: 615Reputation: 615Reputation: 615Reputation: 615Reputation: 615
There's a difference between client port and server port. HTTP servers bind to and listen on port 80. HTTP clients bind to a random high-numbered port on their side before connecting it to the server on port 80.
 
Old 06-22-2010, 08:41 AM   #3
deostroll
Member
 
Registered: Aug 2007
Location: Bangalore
Distribution: fedora
Posts: 113

Original Poster
Rep: Reputation: 15
Suppose a client browser sends a http request to a server @ www.example.org, then we should be technically able to see the port number the client has used to send the HTTP request written to the server logs (@ example.org) right?
 
Old 06-22-2010, 09:51 AM   #4
bigearsbilly
Senior Member
 
Registered: Mar 2004
Location: england
Distribution: Mint, Armbian, NetBSD, Puppy, Raspbian
Posts: 3,515

Rep: Reputation: 239Reputation: 239Reputation: 239
netstat
will give you a clue.

of interest to you, if you have netcat installed.

type
Code:
 nc www.google.com 80
and then type "get".

or be a web server,

Code:
echo hello | nc -l 50123
(it may be nc -lp depending on the version)

and put localhost:50123 in your browser.
 
Old 06-22-2010, 01:46 PM   #5
Sergei Steshenko
Senior Member
 
Registered: May 2005
Posts: 4,481

Rep: Reputation: 454Reputation: 454Reputation: 454Reputation: 454Reputation: 454
Quote:
Originally Posted by deostroll View Post
... how does the browser only receive traffic/data corresponding to the requests it has created...?
HTTP protocol sits on top of TCP/IP, and in the latter packets have source and destination address, i.e. both participants of the WEB conversation know whom they are talking to.
 
Old 06-23-2010, 03:59 AM   #6
graemef
Senior Member
 
Registered: Nov 2005
Location: Hanoi
Distribution: Fedora 13, Ubuntu 10.04
Posts: 2,379

Rep: Reputation: 148Reputation: 148
You might want to take a look at the wireshark tool. It shows all of the packets within a transaction. Unfortunately, if you have other activity going on the computer it will pick those up as well so you will need to learn how to filter the results. I just ran a quick session to pull up the Google home page and there were about 250 packets. Most of those I'm not interested in so since you know that port 80 is the port of interest you can search for that using a filter:
Code:
tcp.port == 80
However a possible better approach would be to start at the beginning and find the DNS packets. For that I used a filter:
Code:
 dns.qry.name contains "www.google.com"
The results from the DNS query tell me that it will establish a link with the server with IP address of 74.125.71.147 With that little piece of knowledge I can set up a filter to look at just the packets sent to that address.
Code:
ip.addr == 74.125.71.147
From these packets displayed I can see what happens before my browser gets anything to display from the web server.

The first three packets are important and for what is known as the three way handshake. My browser sends an synchronise packet [SYN] which tells the web server to respond to me using this IP address and this port - in this case port 50021. The second packet comes from the server and Acknowledges the first packet and asks for acknowledgement in return [SYN, ACK]. The third packet acknowledges [ACK]the servers packet and a connection has been established.

Code:
60	36.616847	192.168.0.101	74.125.71.147	TCP	50021 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=349901752 TSER=0 WS=6
61	36.733250	74.125.71.147	192.168.0.101	TCP	http > 50021 [SYN, ACK] Seq=0 Ack=1 Win=5672 Len=0 MSS=1430 TSV=2935979091 TSER=349901752 WS=6
62	36.733359	192.168.0.101	74.125.71.147	TCP	50021 > http [ACK] Seq=1 Ack=1 Win=5888 Len=0 TSV=349901868 TSER=2935979091
What follows this is the request from the browser and the response from the server.
 
Old 06-23-2010, 09:31 AM   #7
catkin
LQ 5k Club
 
Registered: Dec 2008
Location: Tamil Nadu, India
Distribution: Debian
Posts: 8,578
Blog Entries: 31

Rep: Reputation: 1208Reputation: 1208Reputation: 1208Reputation: 1208Reputation: 1208Reputation: 1208Reputation: 1208Reputation: 1208Reputation: 1208
That's helpful graemef

So it is the choice of a different port (in this case 50021) that enables both participants to uniquely identify TCP packets as belonging to a specific connection. There may be many such uniquely identifiable TCP connections between the same two participant computers.

This text, from Wikipedia, sums it up nicely: "Arriving TCP data packets are identified as belonging to a specific TCP connection by its sockets, that is, the combination of source host address, source port, destination host address, and destination port. This means that a server computer can provide several clients with several services simultaneously, as long as a client takes care of initiating any simultaneous connections to one destination port from different source ports".
 
Old 06-24-2010, 05:44 PM   #8
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Mint
Posts: 17,809

Rep: Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743
moved to General

Neither a Linux nor a Programming question this is....
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Network Traffic Stops After High Traffic windisch Linux - Networking 6 12-17-2007 05:45 PM
Network tool to detect network traffic? cucolin@ Linux - Networking 2 07-30-2007 04:28 PM
LXer: Darkstat - Network Traffic Analyzer or Network Monitor LXer Syndicated Linux News 0 07-04-2006 08:33 AM
Is it possible to put Mozilla Browser into sys tray? kornerr Linux - General 2 03-27-2006 05:34 AM
When the network traffic increase over some limit network works interruptedly therrman Linux - Hardware 0 11-15-2005 02:23 AM

LinuxQuestions.org > Forums > Non-*NIX Forums > General

All times are GMT -5. The time now is 02:47 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration