I'm playing with Wireshark to debug some IoT home automation projects I'm working on. I think I'd benefit from understanding more about how HTTP and TCP/IP are actually working. Most explanations I'm finding describe HTTP as "riding on top of" TCP/IP, but I'm asking more specifically about what is actually being sent.
Here's an example of a client/server interaction I captured:
Client: [SYN]
Server: [SYN, ACK]
Client: [ACK]
If I understand so far, they've now successfully established a TCP connection. The next capture, though, shows me
Client: POST /whatever
Server: 200 OK
Okay now I'm lost. Examining that capture shows me that I have an Ethernet, IP, TCP, and HTTP layer all in one frame. Is it actually as simple as the client adding a bunch of text after the TCP packet ends and squirting those extra bytes over to the router? Which, presumably, then parses the TCP/IP out and forwards it accordingly? This is the source of my confusion. By "rides on top of" is it meant (in a physical sense) that HTTP is just a series of bytes that are sent in the same frame, after the TCP packet? Is the HTTP in this case considered to be the payload of the TCP/IP?
And of course to finish
Server: [FIN, ACK]
Client: [ACK]
Client: [FIN, ACK]
Server: [ACK]
//In this case the server terminates the connection.
Edit: A commenter below asked a question which makes me feel as if I haven't been very clear about what I'm asking.
Imagine that I could stand between my client and the server (or perhaps it would be more accurate to stand between my client and the router and again between the router and the server). Ignoring the considerations when one has to physically send raw data over a physical medium (checksums, error correction codes, etc), what would the actual traffic look like, with respect to time? Would I see bytes for an ethernet layer followed by bytes for an ip layer, tcp, http, and so on?