WireShark doesn't decode gzip'ed http traffic on Windows

Question

Do you guys know why WireShark may refuse to decode gzip'ed http traffic on Windows?

My configuration

• WireShark 1.8.3
• Windows 7 Ultimate x64
• WinPcap 4.1.2

Option "Uncompressed entity bodies" is checked in Preferences / Protocols / HTTP.

Here is how my "Follow TCP Stream" dialog looks like:

When I first open this dialog radio-button below is set to "Raw", but when I click on "ASCII" nothing changes.

Any ideas ?

Zachar

Answer 1

There is support within Wireshark now. Just right click on top of a packet identified as HTTP (Protocol column = HTTP), then "Follow" and "HTTP Stream". This should decode compressed responses into plain text.

Debera

It looks like gzip is only decoded if the website is using HTTP 1. If a website is using HTTP 2 (for example a website using Cloudflare), gzip is not decoded and the option to follow "HTTP steam" is greyed. Any idea how to make it work? – Hixon

Answer 2

If you look at the protocol tree under the "Line-based text data" entry you will see the uncompressed data. The "Follow TCP Stream" dialog just shows the contents of the TCP payload and doesn't interpret it as HTTP or gzipped data or anything else. The buttons on the dialog allow you to set the display format for the stream bytes.

You can right-click on the uncompressed data(see the red # below) and select 'Export Selected Packet Bytes...' to save to a file

Jann

Thank you! Unfortunately I'm not sure I understand what you're referring to. I can't find "Line-based text data" in the UI. Could you please elaborate or/and perhaps add screenshot ? – Zachar

In the packet details pane that lists all the protocols in order, there will be an item at the bottom under the entry for "HyperText Transfer Protocol" called "Line-based text Data". There will also be a complete hex and ASCII dump of the data in the "Uncompressed entity body" in the hex bytes pane. There is also a long-standing enhancement request at bugs.wireshark.org/bugzilla/show_bug.cgi?id=3528 to make the Follow TCP stream dialog show the uncompressed data. – Jann

This is damn unfortunate. I'll take a look at the source code. Perhaps I can implement it. – Zachar

added a screencap to the answer – Swing

@GrahamBloice Bug 3528 is RESOLVED FIXED – Dampier

Answer 3

The accepted answer is the correct answer in terms of current Wireshark -- but is pretty clumsy to use IMO.

So I wrote a small script wireshark-http-gunzip (requires Ruby) to convert the whole output to a format you'd expect. Hope anyone that stumbles here find it useful.

Birdbath

Answer 4

We had an issue that the Line-based text was not visible, make sure to check "Reassemble out-of-order segments" in the TCP configuration.

Georgeanngeorgeanna