Can a packet contains several Websocket? - websocket

Question

I was inspecting the websocket traffic between my server and my browser with Wireshark when I noticed this kind of frame :
No. Time Source Destination Protocol Length Info
144342 8212.033150000 127.0.0.1 127.0.0.1 WebSocket 821 WebSocket Text [FIN]
Frame 144342: 821 bytes on wire (6568 bits), 821 bytes captured (6568 bits) on interface 0
Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)
Internet Protocol Version 4, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: http-alt (8080), Dst Port: 53749 (53749), Seq: 1132, Ack: 603, Len: 755
WebSocket
1... .... = Fin: True
.000 .... = Reserved: 0x00
.... 0001 = Opcode: Text (1)
0... .... = Mask: False
.111 1110 = Payload length: 126 Extended Payload Length (16 bits)
Extended Payload length (16 bits): 140
Payload
Text: {"type":"COLLABORATIVE_COMMANDS","remoteUser":"null","key":"1c78c08f-5d2d-445a-a63c-3a211d2f0336","messageBroadcast":{"smartPath":["null"]}}
WebSocket
1... .... = Fin: True
.000 .... = Reserved: 0x00
.... 0001 = Opcode: Text (1)
0... .... = Mask: False
.111 1110 = Payload length: 126 Extended Payload Length (16 bits)
Extended Payload length (16 bits): 329
Payload
Text [truncated]: {"type":"COLLABORATIVE_COMMANDS","remoteUser":"","key":"1c78c08f-5d2d-445a-a63c-3a211d2f0336","messageBroadcast":{"cameraInfos":{"target":{"x":0,"y":0,"z":0},"camPos":{"x":557.0133301398326,"y":159.5460628202445,"z":342.4
WebSocket
1... .... = Fin: True
.000 .... = Reserved: 0x00
.... 0001 = Opcode: Text (1)
0... .... = Mask: False
.111 1110 = Payload length: 126 Extended Payload Length (16 bits)
Extended Payload length (16 bits): 141
Payload
Text: {"type":"COLLABORATIVE_COMMANDS","remoteUser":"","key":"1c78c08f-5d2d-445a-a63c-3a211d2f0336","messageBroadcast":{"colourEditedMeshes":true}}
WebSocket
1... .... = Fin: True
.000 .... = Reserved: 0x00
.... 0001 = Opcode: Text (1)
0... .... = Mask: False
.111 1110 = Payload length: 126 Extended Payload Length (16 bits)
Extended Payload length (16 bits): 129
Payload
Text: {"type":"COLLABORATIVE_COMMANDS","remoteUser":"","key":"1c78c08f-5d2d-445a-a63c-3a211d2f0336","messageBroadcast":{"explode":"0"}}
Does this mean there are several websockets in my packet ? How is this possible ?

Answer 1

If you read the WebSocket spec, RFC 6455, you will see that WebSocket packets are framed, where each frame has its own header and payload. Remember that TCP is a streaming transport. Senders and receivers are not paying attention to the TCP frames, they are paying attention to the payloads within those frames. A WebSocket sender will send a WebSocket header followed by its payload, followed by the next WebSocket header and its payload, and so on. A WebSocket receiver will read a WebSocket header and its payload, then read the next WebSocket header and its payload, and so on. Typically, the Nagle algorithm is enabled on TCP sockets, and it will split and combine application data into TCP frames as needed for efficient network transmissions. That is handled by the TCP stack transparent to the applications. So yes, it is possible to see multiple WebSocket frames appear inside of a single TCP frame, if that is how Nagle decided to transmit them. If the WebSocket packets are sent in a short period of time, Nagle may merge them so it only has to transmit a single TCP frame instead of separate TCP frames.