title: HTTP Content length less than File byte-size, did it fully download?
body: <p>Trying to determine if a user actually downloaded an executable file from a website.  I examined the pcap and I see that the Content-Length field = 784,536 but the Server->User is 430,380 bytes.  This tells me that the user did not fully download the file. I also downloaded the file myself and see that it is 766 KB.  Is it possible that the content-length value based on the HTTP header will not be EQUAL TO the file size of that EXE file if it is downloaded (the local file size)?  Is this correct?  </p>
  
  <p><strong>Packet Capture Data</strong> (I can't post screenshots)</p>
  
  <pre><code>GET /ChromasLite211Setup.exe HTTP/1.1
  Host: www.technelysium.com.au
  User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:17.0) Firefox/17.0
  Accept: text/html, application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-us
  Accept-Enconding: gzip, deflate
  Connection: keep-alive
  Referrer: http://technelysium.com.au/
  
  HTTP/1.1 200 OK
  Date: Thu, 01 Aug 2013 17:28:17 GMT
  Server: Apache
  Last-Modified: Mon, 15 Apr 2013 08:29:57 GMT
  Accept-Ranges: bytes
  Content-Length: 784536
  Keep-Alive: timeout=5, max=100
  Connection: Keep-Alive
  Content-Type: application/x-msdownload
  
  MZP........................@.............................!..L..This program must be run under Win32
  
  
  Entire Conversation (430722 bytes)
  Users IP -&gt; Server IP (342 bytes)
  Server IP -&gt; Users IP (430380)
  </code></pre>
  
  <p>When I download the file from the site it shows as, "Binary FIle (766 KB)"</p>