Why is the output of tshark `http.file_data` different from the Content Length? [migrated]

I’ve got a PCAP file that has 3,445 HTTP "206 Partial Content" packets for the application/pdf media type. Each of these requests is for the same file, different Content-Ranges are being requested each time as a covert means of d… Continue reading Why is the output of tshark `http.file_data` different from the Content Length? [migrated]