Decode HTTP packet content in python as seen in wireshark

Question

Ok, so bascially what I want to do is intercept some packets that I know contains some JSON data. But HTTP packets aren't human-readable, so that's my problem, I need to make the entire packet (not just the header, which is already plain text), human-readable. I have no experience with networking at all.

import pcap
from impacket import ImpactDecoder, ImpactPacket

def print_packet(pktlen, data, timestamp):
    if not data:
        return

    decoder = ImpactDecoder.EthDecoder()
    ether = decoder.decode(data)
    iphdr = ether.child()
    tcphdr = iphdr.child()

    if iphdr.get_ip_src() == '*******':
        print tcphdr

p = pcap.pcapObject()
dev = 'wlan0'
p.open_live(dev, 1600, 0, 100)

try:
    p.setfilter('tcp', 0, 0)
    while 1:
        p.loop(1, print_packet)
except KeyboardInterrupt:
    print 'shutting down'

I've found tools like libpcap-python, scapy, Impacket pcapy and so on. They all seem good, but I can't figure out how to decode the packets properly with them.

Wireshark has this thing called "Line-based text data: text/html" which basically displays the information I'm after, so I thought it would be trivial to get the same info with python, it turns out it was not.

Answer 1

Both HTTP and JSON are human readable. On Wireshark, select a packet that relates to your HTTP transaction and right-click, select Follow TCP Stream, which should display the transaction in a Human readable form.