[wireshark] How to decompress gzipped contents

source:http://ask.wireshark.org/questions/6598/how-to-decompress-gzipped-contents

Question:
In HTTP request and response, content-encoding is 'gzip' and content is gzipped. Is there a way to decompress the gzipped content so we can see what the contents are.

----------------------------------------------------------------------------------------------------------------------------------------

Japps answer: You could export the objects through the file menu and gunzip them offline.

Anothor answer against to Japps':

I believe Jaap's answer is not quite correct, because the exported object will already be uncompressed. Since there seems to be some confusion, here are some more explicit steps that should hopefully work for you:

1. Find the gzipped object of interest and right-click on the corresponding packet in the packet list, selecting, "Follow TCP Stream" to isolate the stream.
2. Within the "Follow TCP Stream" window, note the name of the gzipped object in the previous GET block.
3. From the main window, choose File -> Export Objects -> HTTP.
4. Select the object. The packet number should match the packet number you discovered in step 1, and the Filename should match the name seen in step 2. Note that the content type that appears is the uncompressed content type, so e.g., text/html, and not gzip.
5. Choose Save As, then Save. This will be the uncompressed object.

Note that you don't necessarily need to do "Follow TCP Stream" as long as you know the packet number and object name of the object of interest, or if you simply want to export all objects.