CODEWITHSUNDEEP
websocketwireshark
WorkInProgress
WorkInProgress

Reputation: 103

Can a packet contains several Websocket?

I was inspecting the websocket traffic between my server and my browser with Wireshark when I noticed this kind of frame : 

No.     Time           Source          Destination   Protocol  Length Info
 144342 8212.033150000 127.0.0.1       127.0.0.1     WebSocket 821    WebSocket Text [FIN] 

Frame 144342: 821 bytes on wire (6568 bits), 821 bytes captured (6568 bits) on interface 0
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: http-alt (8080), Dst Port: 53749 (53749), Seq: 1132, Ack: 603, Len: 755
WebSocket
    1... .... = Fin: True
    .000 .... = Reserved: 0x00
    .... 0001 = Opcode: Text (1)
    0... .... = Mask: False
    .111 1110 = Payload length: 126 Extended Payload Length (16 bits)
    Extended Payload length (16 bits): 140
    Payload
        Text: {"type":"COLLABORATIVE_COMMANDS","remoteUser":"null","key":"1c78c08f-5d2d-445a-a63c-3a211d2f0336","messageBroadcast":{"smartPath":["null"]}}
WebSocket
    1... .... = Fin: True
    .000 .... = Reserved: 0x00
    .... 0001 = Opcode: Text (1)
    0... .... = Mask: False
    .111 1110 = Payload length: 126 Extended Payload Length (16 bits)
    Extended Payload length (16 bits): 329
    Payload
        Text [truncated]: {"type":"COLLABORATIVE_COMMANDS","remoteUser":"","key":"1c78c08f-5d2d-445a-a63c-3a211d2f0336","messageBroadcast":{"cameraInfos":{"target":{"x":0,"y":0,"z":0},"camPos":{"x":557.0133301398326,"y":159.5460628202445,"z":342.4
WebSocket
    1... .... = Fin: True
    .000 .... = Reserved: 0x00
    .... 0001 = Opcode: Text (1)
    0... .... = Mask: False
    .111 1110 = Payload length: 126 Extended Payload Length (16 bits)
    Extended Payload length (16 bits): 141
    Payload
        Text: {"type":"COLLABORATIVE_COMMANDS","remoteUser":"","key":"1c78c08f-5d2d-445a-a63c-3a211d2f0336","messageBroadcast":{"colourEditedMeshes":true}}
WebSocket
    1... .... = Fin: True
    .000 .... = Reserved: 0x00
    .... 0001 = Opcode: Text (1)
    0... .... = Mask: False
    .111 1110 = Payload length: 126 Extended Payload Length (16 bits)
    Extended Payload length (16 bits): 129
    Payload
        Text: {"type":"COLLABORATIVE_COMMANDS","remoteUser":"","key":"1c78c08f-5d2d-445a-a63c-3a211d2f0336","messageBroadcast":{"explode":"0"}}

Does this mean there are several websockets in my packet ? How is this possible ?

Upvotes: 2

Views: 1183

Answers (1)

Remy Lebeau
Remy Lebeau

Reputation: 598001

If you read the WebSocket spec, RFC 6455, you will see that WebSocket packets are framed, where each frame has its own header and payload. Remember that TCP is a streaming transport. Senders and receivers are not paying attention to the TCP frames, they are paying attention to the payloads within those frames. A WebSocket sender will send a WebSocket header followed by its payload, followed by the next WebSocket header and its payload, and so on. A WebSocket receiver will read a WebSocket header and its payload, then read the next WebSocket header and its payload, and so on. Typically, the Nagle algorithm is enabled on TCP sockets, and it will split and combine application data into TCP frames as needed for efficient network transmissions. That is handled by the TCP stack transparent to the applications. So yes, it is possible to see multiple WebSocket frames appear inside of a single TCP frame, if that is how Nagle decided to transmit them. If the WebSocket packets are sent in a short period of time, Nagle may merge them so it only has to transmit a single TCP frame instead of separate TCP frames.

Upvotes: 6

Related Questions