It would be better to stream the captured packets to a proper HTTP parser. That way you can also handle HTTP keepalive. Also, you can set a filter on the pcap

It would be better to stream the captured packets to a proper HTTP parser. That way you can also handle HTTP keepalive. Also, you can set a filter on the pcap session so that pcap only gives you http packets. Then you don't have to check yourself whether you captured non-http.