WireShark doesn't decode gzip'ed http traffic on Windows

Question

Do you guys know why WireShark may refuse to decode gzip'ed http traffic on Windows?

My configuration

WireShark 1.8.3
Windows 7 Ultimate x64
WinPcap 4.1.2

Option "Uncompressed entity bodies" is checked in Preferences / Protocols / HTTP.

Here is how my "Follow TCP Stream" dialog looks like:

enter image description here

When I first open this dialog radio-button below is set to "Raw", but when I click on "ASCII" nothing changes.

Any ideas ?

score 24 · Answer 1 · edited Oct 17 '12 at 18:41

24

If you look at the protocol tree under the "Line-based text data" entry you will see the uncompressed data. The "Follow TCP Stream" dialog just shows the contents of the TCP payload and doesn't interpret it as HTTP or gzipped data or anything else. The buttons on the dialog allow you to set the display format for the stream bytes.

You can right-click on the uncompressed data(see the red # below) and select 'Export Selected Packet Bytes...' to save to a file

enter image description here

edited Oct 17 '12 at 18:41

rupello

8,361
2
37
34

answered Oct 17 '12 at 08:46

Graham Bloice

241
2
2

Thank you! Unfortunately I'm not sure I understand what you're referring to. I can't find "Line-based text data" in the UI. Could you please elaborate or/and perhaps add screenshot ? – expert Oct 17 '12 at 09:03
In the packet details pane that lists all the protocols in order, there will be an item at the bottom under the entry for "HyperText Transfer Protocol" called "Line-based text Data". There will also be a complete hex and ASCII dump of the data in the "Uncompressed entity body" in the hex bytes pane. There is also a long-standing enhancement request at https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3528 to make the Follow TCP stream dialog show the uncompressed data. – Graham Bloice Oct 17 '12 at 13:53
1

This is damn unfortunate. I'll take a look at the source code. Perhaps I can implement it. – expert Oct 17 '12 at 17:08
1

added a screencap to the answer – rupello Oct 17 '12 at 18:37
1

@GrahamBloice Bug 3528 is RESOLVED FIXED – rofrol Apr 01 '18 at 11:40

score 5 · Accepted Answer · answered Oct 18 '19 at 16:56

5

There is support within Wireshark now. Just right click on top of a packet identified as HTTP (Protocol column = HTTP), then "Follow" and "HTTP Stream". This should decode compressed responses into plain text.

answered Oct 18 '19 at 16:56

Iker Jimenez

7,105
9
49
46

1

It looks like gzip is only decoded if the website is using HTTP 1. If a website is using HTTP 2 (for example a website using Cloudflare), gzip is not decoded and the option to follow "HTTP steam" is greyed. Any idea how to make it work? – baptx Apr 24 '20 at 15:43

score 4 · Answer 3 · answered Aug 01 '14 at 16:38

The accepted answer is the correct answer in terms of current Wireshark -- but is pretty clumsy to use IMO.

So I wrote a small script wireshark-http-gunzip (requires Ruby) to convert the whole output to a format you'd expect. Hope anyone that stumbles here find it useful.

WireShark doesn't decode gzip'ed http traffic on Windows

3 Answers3