Wireshark-users: [Wireshark-users] begginer question , how to decode this response
From: Meir Yanovich <meiry242@xxxxxxxxx>
Date: Thu, 15 Jul 2010 15:21:23 +0300
Hello all
im monitoring some http request and getting response that is probbpli encoded and i like to decode the response
how can i do this is wireshark?
here is example when i make follow stream :
--------------------------------------------------------------------------------------------------------------------------------------------
GET /search?q=seo+tutorial&hl=en&sa=N&num=10 HTTP/1.1
Accept-Encoding: gzip
User-Agent: Mozilla/5.0 (compatible; MSIE 6.0; Windows 98; MyIE2)
Host: www.google.com
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
HTTP/1.1 200 OK
Cache-Control: private, max-age=0
Date: Thu, 15 Jul 2010 11:52:11 GMT
Expires: -1
Content-Type: text/html; charset=UTF-8
Set-Cookie: PREF=ID=465d72ba044b3bf8:TM=1279194731:LM=1279194731:S=aFSEZrlacVAlizr3; expires=Sat, 14-Jul-2012 11:52:11 GMT; path=/; domain=.google.com
Set-Cookie: NID=36=jJpFa_FZLkpaMlCBMevvhDgXbtNvXH3wWkmegI-tttyigvb3AxE6g25vVT-jX-G8yXpgIpTP1tdbPYO-60jrNVhZKIgiJ3Wrn6jrAO-1LxJ7u5Vr_WXttWR_OK0ukW_i; expires=Fri, 14-Jan-2011 11:52:11 GMT; path=/; domain=.google.com; HttpOnly
Server: gws
Transfer-Encoding: chunked
Content-Encoding: gzip
ee8
...........:ks.8...W0tEc.)...?$...ydR77.....V&..I.D..4..1...u...Jr.......4.......T$...N.
~..)I...U.:T5..+v.%.T.T#
..D...j...N..ZR.......{.PLqz%.p.J......7Bd.:.(..|160....RW..L...i.......%..5..u..?N...z...........?......t.M^.N/..*..9.......5....=..>T...k.....L.....Y{7?.2si.z......Z..qI.....C?...`..k..l..{....;R;$B.....G##./....o.?lN|Q...ut.M.HjZ$...,.R...N.~.a=...7".$J>.v..-?N.......A..<.O.A.....Z.?@...+M7.-k.?GB..I..$...<.f.w-..)W.f.....L_..{Ocw..F....db..L.H.f.e.HU....T*j;..i].>..t....z.N.J.............y...........L3..c...&...LgG..r.....Q......+g.......G.....7&.w..$..%..H...,.Y...)+....,.,/XQ..I...f..Q3N.j.S..j6...4.nz,......a..9".e....k?.s..i....z......Qr../..E#,...v.`^....f$.I+E..cr
...T..0.^"...*.....F.%Vs{.$..g.q..4.....(.>.
.. .\l9..l..2.8G...}.IL...)DLac.9.b...h....i....j.I.2Yq.8..Hn:....-..5.Pf.f(..........l..]k.W"z">..y.l.,..B..rq...e..u..b......[.t.'Ab..J6[!rRI:..8...3..(A1.....u...T:.t#"V.28..t...9.,....iq.w.....<Y....;.j..h....+.PwG=..j. .{k....f6....O..u....i..............e@xxxxxxxxxxx...}j.....X.v1y..%...h;.=....c5.n.1C.... ..%.P......S...kl......04/.<.....<.....'.Q..X....?;...O...
P..-.........`.uA...k...Sy...t<......y..=.9<_.t.(/.-.IX..E..`.qF...$)...([....j..R.....t...(S..).._.;.x.gcj..7...r........n>.....d..^..J..A.!.Y....R....4V5?.3,6..0.D...*..S.QM+J..)..-D....N.ISg`S}...5...d.g.m.@..[N*.%...wH..:<..U..2....ZF..C.....F..6M5.....w..kS....;>.9-.z..k...,.....]f...Zn.n...wX.u.Qg.'.;
:.Ge.-k.....'..*.4.>....'.e...\)...
...0.s..5.W...........
p..Txc.b....hb.I......q.'N6^k...ln..d....Ek..5.6"$.N..+`....g.Ut......%..fr....C.`$...Ra|G.X&]..(u...7...FD..;..S.u.U'.........'...3.......Y|..d.......ROo........o...8.!\..*.;c8.....pn..*.M.aJ.x.p<.q\.....9.r...`...I.Y....z...-:.Yc....}....I.......6Ku.v....A+Jc1.$...C.
.>.k,......mv.1......i.....9.FOg..r.+g..WDW".....I...-...6.D.tr..da..............?X_pD....1....V.....H.J.R.usHh.P..........z.p>.....{.o...z[....~...A}.W...t.....i.!.h`..1.v.gG.W..$......ddw....v8.m5.=..*~.B..T
9."5.:v...b.~..N...'_?.b....TdR.mB.S5...]}o......r;..r.Vi.|....$n...5....J.T....*...F..1.]......v.......cA:.d=....^...bo.t`..f.0.{.......}.D.).t|.Y...q...R\.j..k.9.R.....lr....]N=d....n!.K.B..k:.;.vHCU...:...J.]Bt..._......mDi..T.rU...._..,x ."..%......e.Q.n.. x.Di?.C.r....xOi.KL.......I...QUy.....p..#.z.sgo0....p6Pa....5.M...f.6g...~.to?.....q.d....29{.^........S.@$..!.3.l!0....c...m.a{.M.l.t ......{..07....pI.s.<~.;......w....8.....K..M......{.W..X.....(.......2.)....~/.
.Q....LHE..:.....ON.I|....y...H6W........+. ;..b_.b.j....;.....d.$r...y...x....Cp}-It.z.o..3)VuB.{..x....$.\...!...y)..}..`*.".....!H....?.=....]...3.}9..;....2@...M.......P.[#P..Zw..q..V..m.u.C..D..t.......R.3.......CD....c.Y.p...c1\......al.....ai.....c<,.:.abR4.Z@*C..O2...v..H.5...D2G.Md{.@v@.....m ..5.g.$.H.}..?i...W..8yM....}....~k).h....HRq.].
r..=(WE...|..5W..c....`#......]G..g..&....*grh...@...Y...=.7(.....).;.ox....).o.Rq...T.&.....m..........Sy/..S.<}.......E.J...i.<..rQU...P..}.1>~m.......
..
OPa.1-.... .[*]$....>...xA. ....."t.<
..DV.ZU...
...VW...b..B.f.jptyv.`...H...nRa".....%.y.X...4....7_e-KV.2..d,.y:~2..R.7.P!R..M.G.M4]?O.u..A.d....m%..o.G>O.;....=1..0..+...y.9.^0.;E.%W.<...X.Ulx.
}..1L..../.....F....eJj ..{v.J\...-.A....%.J.............<.-.....es/s.L...........B .S.........s.&.I..6.w.y..n..U...&!g.......`._.g[.....G..&.+17K..M.i^.B.?Yq.&2.
xW....IS..=$.1........(..u,A.A..|%..UKyK.......T)(...>..(..B..6.J...P..V....rE./.....n_N......S...Y.......Z.B.l.Za.#.e.h....p;........ ..@...VOI.t....;._..S...6.)..E.....!z...6|...~.`*r.....#|E_D.}.......O.UK..-Y...zx...g....zU= ....g.......:.Q..W_c~..!..Ug.....}#`g.}...(.{e^...:.=;u..Z..9..v..2B...}..cc.L...e......t..M.l...M.Fr."..4..%.V<zEs.x.`e.R.~....N...;Z1.~..A.0M.R....+...
.lQ.n. .u.t>:
a'..9'.!M........F...\...Y.b.V7V........c8EC...p.V8....9p....t.}..Y.V. .........)..1.......XA....z._.........
~..)I...U.:T5..+v.%.T.T#
..D...j...N..ZR.......{.PLqz%.p.J......7Bd.:.(..|160....RW..L...i.......%..5..u..?N...z...........?......t.M^.N/..*..9.......5....=..>T...k.....L.....Y{7?.2si.z......Z..qI.....C?...`..k..l..{....;R;$B.....G##./....o.?lN|Q...ut.M.HjZ$...,.R...N.~.a=...7".$J>.v..-?N.......A..<.O.A.....Z.?@...+M7.-k.?GB..I..$...<.f.w-..)W.f.....L_..{Ocw..F....db..L.H.f.e.HU....T*j;..i].>..t....z.N.J.............y...........L3..c...&...LgG..r.....Q......+g.......G.....7&.w..$..%..H...,.Y...)+....,.,/XQ..I...f..Q3N.j.S..j6...4.nz,......a..9".e....k?.s..i....z......Qr../..E#,...v.`^....f$.I+E..cr
...T..0.^"...*.....F.%Vs{.$..g.q..4.....(.>.
.. .\l9..l..2.8G...}.IL...)DLac.9.b...h....i....j.I.2Yq.8..Hn:....-..5.Pf.f(..........l..]k.W"z">..y.l.,..B..rq...e..u..b......[.t.'Ab..J6[!rRI:..8...3..(A1.....u...T:.t#"V.28..t...9.,....iq.w.....<Y....;.j..h....+.PwG=..j. .{k....f6....O..u....i..............e@xxxxxxxxxxx...}j.....X.v1y..%...h;.=....c5.n.1C.... ..%.P......S...kl......04/.<.....<.....'.Q..X....?;...O...
P..-.........`.uA...k...Sy...t<......y..=.9<_.t.(/.-.IX..E..`.qF...$)...([....j..R.....t...(S..).._.;.x.gcj..7...r........n>.....d..^..J..A.!.Y....R....4V5?.3,6..0.D...*..S.QM+J..)..-D....N.ISg`S}...5...d.g.m.@..[N*.%...wH..:<..U..2....ZF..C.....F..6M5.....w..kS....;>.9-.z..k...,.....]f...Zn.n...wX.u.Qg.'.;
:.Ge.-k.....'..*.4.>....'.e...\)...
...0.s..5.W...........
p..Txc.b....hb.I......q.'N6^k...ln..d....Ek..5.6"$.N..+`....g.Ut......%..fr....C.`$...Ra|G.X&]..(u...7...FD..;..S.u.U'.........'...3.......Y|..d.......ROo........o...8.!\..*.;c8.....pn..*.M.aJ.x.p<.q\.....9.r...`...I.Y....z...-:.Yc....}....I.......6Ku.v....A+Jc1.$...C.
.>.k,......mv.1......i.....9.FOg..r.+g..WDW".....I...-...6.D.tr..da..............?X_pD....1....V.....H.J.R.usHh.P..........z.p>.....{.o...z[....~...A}.W...t.....i.!.h`..1.v.gG.W..$......ddw....v8.m5.=..*~.B..T
9."5.:v...b.~..N...'_?.b....TdR.mB.S5...]}o......r;..r.Vi.|....$n...5....J.T....*...F..1.]......v.......cA:.d=....^...bo.t`..f.0.{.......}.D.).t|.Y...q...R\.j..k.9.R.....lr....]N=d....n!.K.B..k:.;.vHCU...:...J.]Bt..._......mDi..T.rU...._..,x ."..%......e.Q.n.. x.Di?.C.r....xOi.KL.......I...QUy.....p..#.z.sgo0....p6Pa....5.M...f.6g...~.to?.....q.d....29{.^........S.@$..!.3.l!0....c...m.a{.M.l.t ......{..07....pI.s.<~.;......w....8.....K..M......{.W..X.....(.......2.)....~/.
.Q....LHE..:.....ON.I|....y...H6W........+. ;..b_.b.j....;.....d.$r...y...x....Cp}-It.z.o..3)VuB.{..x....$.\...!...y)..}..`*.".....!H....?.=....]...3.}9..;....2@...M.......P.[#P..Zw..q..V..m.u.C..D..t.......R.3.......CD....c.Y.p...c1\......al.....ai.....c<,.:.abR4.Z@*C..O2...v..H.5...D2G.Md{.@v@.....m ..5.g.$.H.}..?i...W..8yM....}....~k).h....HRq.].
r..=(WE...|..5W..c....`#......]G..g..&....*grh...@...Y...=.7(.....).;.ox....).o.Rq...T.&.....m..........Sy/..S.<}.......E.J...i.<..rQU...P..}.1>~m.......
..
OPa.1-.... .[*]$....>...xA. ....."t.<
..DV.ZU...
...VW...b..B.f.jptyv.`...H...nRa".....%.y.X...4....7_e-KV.2..d,.y:~2..R.7.P!R..M.G.M4]?O.u..A.d....m%..o.G>O.;....=1..0..+...y.9.^0.;E.%W.<...X.Ulx.
}..1L..../.....F....eJj ..{v.J\...-.A....%.J.............<.-.....es/s.L...........B .S.........s.&.I..6.w.y..n..U...&!g.......`._.g[.....G..&.+17K..M.i^.B.?Yq.&2.
xW....IS..=$.1........(..u,A.A..|%..UKyK.......T)(...>..(..B..6.J...P..V....rE./.....n_N......S...Y.......Z.B.l.Za.#.e.h....p;........ ..@...VOI.t....;._..S...6.)..E.....!z...6|...~.`*r.....#|E_D.}.......O.UK..-Y...zx...g....zU= ....g.......:.Q..W_c~..!..Ug.....}#`g.}...(.{e^...:.=;u..Z..9..v..2B...}..cc.L...e......t..M.l...M.Fr."..4..%.V<zEs.x.`e.R.~....N...;Z1.~..A.0M.R....+...
.lQ.n. .u.t>:
a'..9'.!M........F...\...Y.b.V7V........c8EC...p.V8....9p....t.}..Y.V. .........)..1.......XA....z._.........
14e0
.]{o.F...~
V...b..D....^../..8.b!P$E..D.CI.....\l7.v............I.93$EJ..9V....MIj8sf........*B.....q$.#. .m. _.c...^QM.....U...=...n.f..I...Zdk)k...........4.....E..A[........U..9G....WFFSm...F.n1
.Z...a..S[....A.._...........^
...pR..q.(..K.[..~....~...Q.{
..h<K.....B....2.n+N..*...s.E...{..W..h.#G...........].o......@.v......9.S....0.9..N.{!...=..d.vW..}.6...4...&(r..x..v.. .M.(.n.... ..L6z.;d.+..b5srH.{....Gg...q.U..z...(_!q.d.~}:9.5.....~)...3-.3.....AKN.f.21...|F+..^qR........n
.zC..n{...I..8qR..d.PoN./..u...+t.Gc......%.Wdq..]..+...=....e.UF.5....a.(&.Z..zg.z.....v.*!4.R.P.Duc.......!...f..tt.O.9Q..oa...
.....r .$.)A.l;.Qt+g..........7............o..r.i..'U....vtRb...f......qH".i^.7...~../...n..._f..*..s.:..R.f.rp.g..q.....7...<x......B.~.....uc....*.......6.q......h.....t.. ....,]..^g......w...1_.C.........r..jN.....m.U/../..[qZ?..^.)..<U=i.q>>....C......Q..(.:f7.ih............g5....u.....i..JU`)....8.GH.....?..|<..\m@S......%...8...9.]Gcl.kX&..g.$....I*..g.V..\.VLUb.Tu.$.6U}{..4...G..JCg..0U..r.......l.X.........F-...8.k....U....%..*...d..,....m.4..H....WL...H\............u....
G...;.m-|..I...C......eD..._..?.~.....@.
....*...f.A......W.V*H>.......I..........Xu_...n.Wh........<...u......?CyE\.+W..U.......|...L.K......,..W....%..yer4..y.W
..p..l..].+Jo.H..A.Us..Tc..I...T.s('...nt....Y..T....!^]d......
.qmv.mk*.*...h. .Fm ........`....e.W@IhhQ.h=._bh.}....%
.........%u|...z...Br.....w....L_Sn.~.SP=...o..7.->....(._...|../....B.a..Aw!..........%.Um...`.:LAa>.+81.....w...MG...j.{Y.y.......ne*~N......H........b....j..Z..I..v../....tx|.....\....+..*..@..^......Zd......^.T....S.YIH+..O.yQ..^R2m>..%c*.'..E..*{~.O.?....`...}.. ...n.qT .....y.2.?i.o........|..W..7...Y.;*.....|...[...+[..b.........&..m..3*...w>&.Z./..$e....]Q.*........'..0...W..j.d..>a9.9...$.=......M.uNR..j..D...).._...b0....n).ZT.B...oC....M
].N>.8Yp.8...];T">`..{,..Y>
.v7uv..W..Ww....).....|.....dR.....EZ.r.p.*..-.L.s.n$oK'.Zl.......E.........".6ZBO..o...u......-.`.[h8;L`....wm.h..{kC..g.sq..i.psU...aZ..\..G&..4].......C.`.....I$...1X.0i.....B(b.......g.;..,..K.....U......j...52T.%..h.]6T.,Lk.....#....E.6.Ps..)
.u.U>.DId+..w.L.<{..tr.....I....(...i.a/vC_t]6.....;Q.X.....([._./..=._.Q..!*{.#<..*/..g_......m~'..A.D^t.W...........sw.J.-..2z..F..L.~.F.^'...s..b^....1Ax.G...5.}....x....w.8.|.!...e.d..a...9......wx..e........~!...p.....=...MWH...<!.B.:..X..._......b>......@..._....<...j..(...N'.>?..%.Qx..l....
._..ks.P.LR.r..E."dY..y......+.\.U..w............r...n..........nP..........~..6ZA...9.5cy2.B`:7f..'...`....I5...nk..a}..y|.....\l..+.9..."...B.Y+..."y
--------------------------------------------------------------------------------------------------------------------------------------------
V...b..D....^../..8.b!P$E..D.CI.....\l7.v............I.93$EJ..9V....MIj8sf........*B.....q$.#. .m. _.c...^QM.....U...=...n.f..I...Zdk)k...........4.....E..A[........U..9G....WFFSm...F.n1
.Z...a..S[....A.._...........^
...pR..q.(..K.[..~....~...Q.{
..h<K.....B....2.n+N..*...s.E...{..W..h.#G...........].o......@.v......9.S....0.9..N.{!...=..d.vW..}.6...4...&(r..x..v.. .M.(.n.... ..L6z.;d.+..b5srH.{....Gg...q.U..z...(_!q.d.~}:9.5.....~)...3-.3.....AKN.f.21...|F+..^qR........n
.zC..n{...I..8qR..d.PoN./..u...+t.Gc......%.Wdq..]..+...=....e.UF.5....a.(&.Z..zg.z.....v.*!4.R.P.Duc.......!...f..tt.O.9Q..oa...
.....r .$.)A.l;.Qt+g..........7............o..r.i..'U....vtRb...f......qH".i^.7...~../...n..._f..*..s.:..R.f.rp.g..q.....7...<x......B.~.....uc....*.......6.q......h.....t.. ....,]..^g......w...1_.C.........r..jN.....m.U/../..[qZ?..^.)..<U=i.q>>....C......Q..(.:f7.ih............g5....u.....i..JU`)....8.GH.....?..|<..\m@S......%...8...9.]Gcl.kX&..g.$....I*..g.V..\.VLUb.Tu.$.6U}{..4...G..JCg..0U..r.......l.X.........F-...8.k....U....%..*...d..,....m.4..H....WL...H\............u....
G...;.m-|..I...C......eD..._..?.~.....@.
....*...f.A......W.V*H>.......I..........Xu_...n.Wh........<...u......?CyE\.+W..U.......|...L.K......,..W....%..yer4..y.W
..p..l..].+Jo.H..A.Us..Tc..I...T.s('...nt....Y..T....!^]d......
.qmv.mk*.*...h. .Fm ........`....e.W@IhhQ.h=._bh.}....%
.........%u|...z...Br.....w....L_Sn.~.SP=...o..7.->....(._...|../....B.a..Aw!..........%.Um...`.:LAa>.+81.....w...MG...j.{Y.y.......ne*~N......H........b....j..Z..I..v../....tx|.....\....+..*..@..^......Zd......^.T....S.YIH+..O.yQ..^R2m>..%c*.'..E..*{~.O.?....`...}.. ...n.qT .....y.2.?i.o........|..W..7...Y.;*.....|...[...+[..b.........&..m..3*...w>&.Z./..$e....]Q.*........'..0...W..j.d..>a9.9...$.=......M.uNR..j..D...).._...b0....n).ZT.B...oC....M
].N>.8Yp.8...];T">`..{,..Y>
.v7uv..W..Ww....).....|.....dR.....EZ.r.p.*..-.L.s.n$oK'.Zl.......E.........".6ZBO..o...u......-.`.[h8;L`....wm.h..{kC..g.sq..i.psU...aZ..\..G&..4].......C.`.....I$...1X.0i.....B(b.......g.;..,..K.....U......j...52T.%..h.]6T.,Lk.....#....E.6.Ps..)
.u.U>.DId+..w.L.<{..tr.....I....(...i.a/vC_t]6.....;Q.X.....([._./..=._.Q..!*{.#<..*/..g_......m~'..A.D^t.W...........sw.J.-..2z..F..L.~.F.^'...s..b^....1Ax.G...5.}....x....w.8.|.!...e.d..a...9......wx..e........~!...p.....=...MWH...<!.B.:..X..._......b>......@..._....<...j..(...N'.>?..%.Qx..l....
._..ks.P.LR.r..E."dY..y......+.\.U..w............r...n..........nP..........~..6ZA...9.5cy2.B`:7f..'...`....I5...nk..a}..y|.....\l..+.9..."...B.Y+..."y
--------------------------------------------------------------------------------------------------------------------------------------------
how to decode this gibrish ?
Thanks
- Follow-Ups:
- Prev by Date: [Wireshark-users] Output of 'tshark -T fields' with multiple occurrences of a field
- Next by Date: [Wireshark-users] ssl.handshake and ring buffer capture
- Previous by thread: Re: [Wireshark-users] [Wireshark-dev] Output of 'tshark -T fields' with multiple occurrences of a field
- Next by thread: Re: [Wireshark-users] begginer question , how to decode this response
- Index(es):