This project is read-only.

Decompress Gzip and Chunked HTTP response

Apr 28, 2012 at 5:49 AM

Hi im making a packet sniffer by using this library. the problem is unchunking and ungzipping chunked and gzipped HTTP response.

here is a example byte array that needs to be unchunked and gunzipped.

... ....6..F..E..LU.@....uB..(.....PS..WT@}...P..~....HTTP/1.1 200 OK Date: Fri, 07 Oct 2011 19:03:09 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive Pragma: no-cache Cache-Control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Content-Encoding: gzip \r\n\r\n10\r\n...................\r....6..F..E.....@...9.B..(.....P.\t.y....C.P..~T...480\r\n.V[o.6..+.....%...AZ.)P.H.b...\t.(...S.BR...}.....C1.O..A...wx>..Li.........T{.pD<.-.........0.o2.]....2...'..#.y.?_...CW.[.x.N.9s....t...i../+.giQ.v.^..Y0.X\\..F.P..8._...yx>[L..to.o-.&.r~>......e.u.%.......L...6....\\.N....,...UT..,.(..R.1S.!LI.$.}.k.S.9.).FRt.3.D.....Z3.d9..\rOF@h ....Z...E..,/.w..O./SzC5..#O.J.>0+T.....2..FF........]...r)...........IA...\\G...X8.f.I-........N.r.....\nF.....\\G...g*.{.Lr.3.%...I..#79gk\"3....DY..X..|.i.4#.<SY;.?....oqD>......m.V~.\n .;.}L.c...{.r$.v.....@X.)....j.....l.C.D~.U&$.Wy.^...9..K...n..,.K..=.E...\".k.aJ-.\n.d....O..6.{.....c...O.._.._se..<...z.\t...h..}.]Zt=......[@h.gt}fJ6....|.N_w..|1Y.. ~.?V.;............4.Q...O.....}. ...4I4..JG....&.....Y.pM...L.0$...r>.EW%..5.A..4..S[...,8..hwW......D..m....b8Sej.]............4...R...4=..BLU..6\...m..8..~..\n{-.....%.cL..<)..1.8..#.^3.E..T..3.q|..\"....D........i...u.....r....:.. 7h...8.-..?...3...jU....\tW.'...k...(.!.!.aB.^.rP....{|\t.....|......<......~....u.\\r\\.....V=...)......... R.s.CW........#..'5.H.gw......{.vhi....\t\t\n......eF...Nv%..F..x........k.95L4...\r\n.IS..........\ t.&..Jx..D..Y..Z...r)q..&..h.^!.h...F.....v....w.$q...F.>...6.w.\\.zf.......t?.]k.7.....\r\n..6..F...\r....E..(* @...;.....B..(.\t.P..C..y.qP..........\r....6..F..E.....@...;[B..(.....P.\t.y.q..C.P..~G...2aa\r\n.XM..0..+..n.....B........\r..m.\r.K.C...w...?J.tQA.R9.c{<3....y \t}.F\"..f.3..yE...}n7.....8..U.wag?A...SB.....>=..q....<]Dg..d...l.........-....Ju.6.<8.X.U.0nC..;Q17...b..p...z....{.......Y.....H.....V.J|....D....5{..1.....+...d.[.-Go.d....K=..W...E...Y.kX..4........)qF.......{...Q.H..F.\D..!!i.C...o..Q...G.}...Q..:...g......... .....j{..HV.....-..........R.,~....B..../..TIa..v.=Fp...Y.\Ffp.....^u.p..\C\t'!.uKZ..be.?Jq..c.H./...A...<.6oa1....6..5.{..\"...#..?..|6??.<....Wu.....>.O.O..c.)O.~.E.v....]h!i....:.tV.-....;...l.I...j<.>&.1.....Z..R.\r...tW.\n\n..C...d.EM..)f.8...<..Y......}...d<...y.T=i.,.3.(f.>.... ..x\".j\tL..Zpg.vh$.v...\"S..VnIk..............u+.8...R.&1.(.....O.....\r\n..6..F...\r....E..(*!@... :.....B..(.\t.P..C..y.\"P.~........\r....6..F..E..<..@...=.B..(.....P.\t.y.\"..C.P..~....a\r\n..:... ....\r\n0\r\n\r\n"

according to RFC the response is first gzipped and then chunked. 

Please Help im in urgent need for a solution.

 

Apr 28, 2012 at 10:16 AM

Pcap.Net currently doesn't support decompressing Gzip and dechunk.

I believe this is a feature that would be more useful after Pcap.Net would support TCP reconstruction.

Meanwhile, you can use Pcap.Net to get the HTTP data and decompress that gzip and dechunk it yourself.