Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking at a device wireshark recording and see something weird.

After I completed the DNS resolve transaction (query + resonse), I immediately get an HTTP response (200 OK) from the responding server.

the site is a standard public site:

Any ideas what is happening here?

share|improve this question
Did you verify the source and destination IPs/ports? Maybe, this is a response to an early request. We can not tell exactly what is happening from the provided information! – Khaled Jan 4 '12 at 12:59
It's a mobile device, maybe something special that tells the server that if I DNS him, he should send something and avoid data consumption? – Boaz Jan 4 '12 at 13:34

CRL is Certificate Revocation List. It should be used by all SSL certificates (each cert contains an URL for CRL of its Certification Authority). Browser and any other program using the cert should first check the CRL list to see if the certificate has not been revoked in the meantime. I don't know how the checking exactly works, but the HTTP response is probably for some earlier request, maybe for some other certificate.

share|improve this answer

Wireshark allows you to follow the stream of a specific packet. If you do that, does it include the DNS lookup you referred to? Or is it possible that it's a response from a different stream, like others have mentioned?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.