Study of Abnormal TCP/HTTP Connection

Abstract: Web browsing activities have increased to huge volumes in the last decade, causing more interest in the analysis of Web trac to extract user action. TCP, the transport layer protocol and HTTP, the application layer protocol plays a major role in Web browsing activities. In this thesis an attempt has been made to investigate the anomalies of TCP terminations in an application layer environment. An experimental setup has been devised in in an isolated manner to observe the e ect of di erent Web browsers, Web servers and contents type on the termination of TCP ports. The results in this thesis show that the anomaly of the termination of TCP port with a reset(RST) flag is usually caused by a Web browser. Further we conclude that the amount of RSTs rise while accessing video based contents due to the increased number of ports while accessing the contents of Web page. In this report ,we further describe and quantify the di erent causes and their contribution in generating RSTs during Web browsing.