WireShark doesn't decode gzip'ed http traffic on Windows

http gzip wireshark network-analysis
expert picture expert · Oct 17, 2012 · Viewed 13.6k times · Source

Do you guys know why WireShark may refuse to decode gzip'ed http traffic on Windows?

My configuration

  • WireShark 1.8.3
  • Windows 7 Ultimate x64
  • WinPcap 4.1.2

Option "Uncompressed entity bodies" is checked in Preferences / Protocols / HTTP.

Here is how my "Follow TCP Stream" dialog looks like:

enter image description here

When I first open this dialog radio-button below is set to "Raw", but when I click on "ASCII" nothing changes.

Any ideas ?

Answer

Graham Bloice picture Graham Bloice · Oct 17, 2012

If you look at the protocol tree under the "Line-based text data" entry you will see the uncompressed data. The "Follow TCP Stream" dialog just shows the contents of the TCP payload and doesn't interpret it as HTTP or gzipped data or anything else. The buttons on the dialog allow you to set the display format for the stream bytes.

You can right-click on the uncompressed data(see the red # below) and select 'Export Selected Packet Bytes...' to save to a file

enter image description here

Related questions

Transfer-Encoding: gzip vs. Content-Encoding: gzip

What is the current state of affairs when it comes to whether to do Transfer-Encoding: gzip or a Content-Encoding: gzip when I want to allow clients with e.g. limited bandwidth to signal their willingness to accept a compressed response …

Read More
Easy HTTP requests with gzip/deflate compression

I'm trying to figure out how the best way to easily send HTTP/HTTPS requests and to handle gzip/deflate compressed responses along with cookies. The best I found was https://github.com/mikeal/request which handles everything except compression. …

Read More
GZIPInputStream to String

I am attempting to convert the gzipped body of a HTTP response to plaintext. I've taken the byte array of this response and converted it to a ByteArrayInputStream. I've then converted this to a GZIPInputStream. I now want to read …

Read More