up vote -1 down vote favorite
share [g+] share [fb]

I'm looking at a device wireshark recording and see something weird.

After I completed the DNS resolve transaction (query + resonse), I immediately get an HTTP response (200 OK) from the responding server.

the site is a standard public site: crl.verisign.net

Any ideas what is happening here?

link|improve this question
1  
Did you verify the source and destination IPs/ports? Maybe, this is a response to an early request. We can not tell exactly what is happening from the provided information! – Khaled Jan 4 at 12:59
It's a mobile device, maybe something special that tells the server that if I DNS him, he should send something and avoid data consumption? – Boaz Jan 4 at 13:34
feedback

2 Answers

up vote 0 down vote

CRL is Certificate Revocation List. It should be used by all SSL certificates (each cert contains an URL for CRL of its Certification Authority). Browser and any other program using the cert should first check the CRL list to see if the certificate has not been revoked in the meantime. I don't know how the checking exactly works, but the HTTP response is probably for some earlier request, maybe for some other certificate.

link|improve this answer
feedback
up vote 0 down vote

Wireshark allows you to follow the stream of a specific packet. If you do that, does it include the DNS lookup you referred to? Or is it possible that it's a response from a different stream, like others have mentioned?

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.