a 404 is identical to any other response.
if we look at a HTTP response message:
----
{RESPONSE LINE}\r\n
{HEADERS}\r\n
\r\n
{MESSAGE}
----
where {RESPONSE LINE} is as follows:
{HTTP_VERSION} {STATUS_CODE} {STATUS_STRING}
The status code is used by the browser to determine the outcome of a request for example 200 for "OK" and 404 for "NOT FOUND", the status string is for the user.
When a user makes a request for a page that is valid, you will I am guessing be sending:
---
HTTP/1.1 200 OK\r\n
\r\n
{FILE CONTENT}
---
so finally we get to an error, when the page requested is not found:
---
HTTP/1.1 404 Not Found\r\n
\r\n
{ERROR PAGE}
---
when the file that the user is requesting is not available, you can switch to an error page and send that instead, the browser would still recognize it as an error!
hope it helps,
you don't need to capture packets
thats a lil extreme for me anyway
-phrosys