Re: [Ethereal-users] uncompressing a gzip'ed http response that spans multiple packets

[Guy Harris <guy@xxxxxxxxxxxx>]

On Sep 5, 2006, at 5:34 PM, ethereal.x.jsd@xxxxxxxx wrote:

> -------------------
> The Ethereal project is being continued at a new site.  Please go to
> http://www.wireshark.org and subscribe to wireshark-users@xxxxxxxxxxxxx 
> .
> Don't forget to unsubscribe from this list at
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> -------------------
>
> Using ethereal 0.99, I am trying to trace an http response that is
> split across multiple packets.  For the first packet, I can use the
> packet details window to see the text of the response (there's a line
> in that pane saying "Line-based text data: text/html").  However, in
> subsequent packets, there's no text, just a line that says "Data (xxx
> bytes)".
>
> How can I see the unzipped text of each packet?

You can't.  (Is the concept of "the unzipped text of each packet" even  
*meaningful*?  Can there not be a sequence of compressed bytes that  
constitutes a single item in the compressed stream that's split  
between two TCP segments, so that neither of them can be decompressed  
without the other?)

You can, however, turn on HTTP header and body reassembly in the  
preferences for HTTP; that should allow the *entire* body to be  
gunzipped.