title: Wireshark: understanding the contents of youtube video capture file
body: <p>Here is <a href="https://bitbucket.org/all3fox/pcaps/src/87492473430ab86d627519b8ab4eb614ee599359/youtube-f90c96bd7fe6ee57aded33400e461453.pcapng?at=master#" rel="nofollow">a link to a <code>.pcapng</code></a> file which holds the first 30 seconds of a single youtube video. It was preprocessed in the following way:</p>
  
  <ol>
  <li>I used the display filter <code>http.request.uri contains "crossdomain.xml"</code> to learn the ip address of the client and the server.</li>
  <li>Using those addresses, I singled out the video stream with the following display filter <code>ip.addr == ip1 &amp;&amp; ip.addr == ip2</code> and uploaded the resulting capture file.</li>
  </ol>
  
  <p>The original video is <a href="http://www.youtube.com/watch?v=Z7MLjQxGiVs" rel="nofollow">this one</a>.</p>
  
  <p>Now the questions:</p>
  
  <ol>
  <li><p>There are two ports used by the client: <code>57057</code> and <code>57058</code> (and the first one is used for much less traffic than the second). Why are there two ports?</p></li>
  <li><p>The conversation via <code>57057</code> starts with a weird <code>GET /generate_204</code> request which gets a <code>204 No Content</code> response. Yet a few packets later there is a <code>GET /videoplpayback*</code> request which seems to be fullfilled. What does this <code>204 No Content</code> mean?</p></li>
  </ol>
  
  <p>Please note I am a network noob</p>