From: mkcon@... (Martin Kahlert)
Date: 2004-09-07T16:15:10+09:00
Subject: Re: How to parse network traffic from tcpdump in ruby?

Hi!

It's me again.
The pcap ruby library is great!
Works like a charm for me.

The only problem is this:
I sniffed the network traffic while surfing the web (only one 
computer involved and only one Internet Exlorer open).

How can i find out the client's request for any server response?
I tried using the ack and seq numbers for that, but they seem
to be quite independent.

For example:
i click a link and before the server had time to send it to
me (completely) i click another one.
How do i know, which packats belong to witch request?
If the server sends the second part of the first requested page
it could have received the second request and has to ack that one
in the first request-response.  

Is there an easy way to find out the correct package history?

I want to use the requests (especially the filenames/hostnames)
in order to set up a dummy webspace with the corresponding html documents
i can browse through.

Thanks for any help
Martin.