Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking at a device wireshark recording and see something weird.

After I completed the DNS resolve transaction (query + resonse), I immediately get an HTTP response (200 OK) from the responding server.

the site is a standard public site: crl.verisign.net

Any ideas what is happening here?

share|improve this question
1  
Did you verify the source and destination IPs/ports? Maybe, this is a response to an early request. We can not tell exactly what is happening from the provided information! –  Khaled Jan 4 '12 at 12:59
    
It's a mobile device, maybe something special that tells the server that if I DNS him, he should send something and avoid data consumption? –  Boaz Jan 4 '12 at 13:34
add comment

2 Answers

CRL is Certificate Revocation List. It should be used by all SSL certificates (each cert contains an URL for CRL of its Certification Authority). Browser and any other program using the cert should first check the CRL list to see if the certificate has not been revoked in the meantime. I don't know how the checking exactly works, but the HTTP response is probably for some earlier request, maybe for some other certificate.

share|improve this answer
add comment

Wireshark allows you to follow the stream of a specific packet. If you do that, does it include the DNS lookup you referred to? Or is it possible that it's a response from a different stream, like others have mentioned?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.