i'm working on a tcp listener project on c#. I'm using pcap.net for packet capture. But when i'm trying to get the http message with such command like tcp.Http.Decode(Encoding.UTF8), i get some encrypted script. I'm listening on sites that not using SSL protection. I tried tcp.Http.ToMemoryString() then decode it with UTF8 with bytes I can get the Http header properly but i cant get the HTTP message in a readable form. Any ideas how can i do it or am i missing something?
Asked
Active
Viewed 801 times
0
Gökberk Açıkgöz
- 3
- 1
- 5
-
It could be compressed, check the transport encoding header – Joni May 22 '17 at 07:23
-
oh i' ve tried that too with gzip and deflate but there is a problem comes up with that too. A magic number error do you have any idea about how to fix it? – Gökberk Açıkgöz May 22 '17 at 16:56
1 Answers
1
You should use the HttpDatagram.Body property to get the body.
This would return the parsed body part of the HTTP packet.
Note though that you are parsing a single packet, so you will only get the data from that packet, which might not contain the entire HTTP response body.
brickner
- 6,595
- 3
- 41
- 54
-
i get all packets of the site, it must be a data maybe a little bit of data must be in a packet. It's looking like compressed or encoded can you help me with that? – Gökberk Açıkgöz May 23 '17 at 11:17
-
If it's not the first packet, you will have to first do TCP reconstruction and then parse the data. – brickner May 25 '17 at 10:34