# Protos/http/http.go are packets in disorder handled?

**URL:** <https://discuss.elastic.co/t/protos-http-http-go-are-packets-in-disorder-handled/40899>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [February 3, 2016, 6:33pm UTC](https://discuss.elastic.co/t/protos-http-http-go-are-packets-in-disorder-handled/40899 "2016-02-03T18:33:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![patricio.dorantes](https://avatars.discourse-cdn.com/v4/letter/p/bb73d2/32.png) [@patricio.dorantes](https://discuss.elastic.co/u/patricio.dorantes)\
**Post date:** [February 3, 2016, 6:33pm UTC](https://discuss.elastic.co/t/protos-http-http-go-are-packets-in-disorder-handled/40899/1 "2016-02-03T18:33:10Z")

</div>

I'm trying to understand packetbeat http code to monitor fcgi. I'm new in go language but the code below suggests me that streams are not separated by tcptuples just by dir. So if tcp packets are in disorder from different conversations streams got mixed right? Is this on propose just sampling and discarding anything that doesn't come order? I'm missing anything?

```auto
        st := conn.Streams[dir]
        if st == nil {
            st = newStream(pkt, tcptuple)
            conn.Streams[dir] = st
        } else {
            // concatenate bytes
            st.data = append(st.data, pkt.Payload...)

```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [February 4, 2016, 10:48am UTC](https://discuss.elastic.co/t/protos-http-http-go-are-packets-in-disorder-handled/40899/2 "2016-02-04T10:48:37Z")

</div>

The packetbeat/protos/tcp module keeps track of tcp connections having one context object per connection.. The conn object in http module lifes right in the TCP connection context. No crosstalking between multiple streams.

Only problem with passive network analyzers is, you might start sniffing right from "inside" an active connection. In this case you see the response, but never a request. But after this startup phase (and given we do not experience packet loss) messages should be mostly in order.

---

<div class="post-metadata">

**Author:** ![patricio.dorantes](https://avatars.discourse-cdn.com/v4/letter/p/bb73d2/32.png) [@patricio.dorantes](https://discuss.elastic.co/u/patricio.dorantes)\
**Post date:** [February 4, 2016, 3:54pm UTC](https://discuss.elastic.co/t/protos-http-http-go-are-packets-in-disorder-handled/40899/3 "2016-02-04T15:54:09Z")

</div>

Thank you! This information is really useful. So now I can assume object "private" is uniquely handled per TCP stream.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [February 4, 2016, 4:50pm UTC](https://discuss.elastic.co/t/protos-http-http-go-are-packets-in-disorder-handled/40899/4 "2016-02-04T16:50:00Z")

</div>

Right, the `private` parameter is private to the tcp stream.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:56pm UTC](https://discuss.elastic.co/t/protos-http-http-go-are-packets-in-disorder-handled/40899/5 "2017-07-05T21:56:02Z")

</div>