wireshark lua dissector to get uncompressed entity body

457 views Asked by At

So I need to process the text content, it's a special web service format. Before that I need to get the uncompressed text itself. However, the buffer passed into the dissector function seems to be the whole frame, including the HTTP header and the gzip content. Is there anyway to get the uncompressed content?

The MIME type is text/html.

1

There are 1 answers

0
AudioBubble On BEST ANSWER

...and if it doesn't have a media type (as indicated by your ask.wireshark.org question), you'll need to write a heuristic dissector and register it in the "http" heuristic dissector table. See the doc/README.heuristic file in the source for the version of Wireshark you're using. Note that you will have to write this dissector in C, as there is currently no support for heuristic Lua dissectors.