How can you identify HTTP responses that use chunked transfer encoding?

• A. Check the HTTP header for Transfer-Encoding: chunked; Wireshark shows this in the HTTP headers.
• B. Check the DNS rcode.
• C. Look for HTTP 200.
• D. Look for a TCP zero window.

Answer: (A)

Chunked transfer encoding is identified in HTTP responses by the header Transfer-Encoding set to chunked. When you inspect the HTTP layer in Wireshark, you’ll see this header in the response, which tells you the body is being sent in chunks rather than with a fixed Content-Length. The body itself is composed of chunks, each starting with its size in hexadecimal, followed by the data, and ending with a final chunk of size zero. This mechanism allows sending data as it’s generated, without knowing the total length in advance. The other options don’t indicate chunking: DNS rcode is about DNS, an HTTP 200 status just means success, and a TCP zero window is about TCP flow control, not how the HTTP payload is framed.