Use tshark to search http gzip encoded

Question

So...topic says it. I'm attempting to do something like ngrep (which for some reason isn't working on my pcaps). I'm trying to search for an item in a gzip encoded pcap, but I'm having a rough go of it. Here's what I've tried:

tshark -o http.decompress_body:TRUE -r _test.pcap -R 'data-text-lines contains Commentary'

But it's not seeming to fly. Any hints on how to look into an http body that's gzip'ed with tshark? I know I can do this with wireshark, but I'd like to do it with tshark on a remote machine. Thank you.

Answer 1

Seems to work fine with me:

$ tshark -o http.decompress_body:FALSE -nlr http-compression-ipv6.pcap -R 'data-text-lines contains "apply"'
$ tshark -o http.decompress_body:TRUE -nlr http-compression-ipv6.pcap -R 'data-text-lines contains "apply"'
 90   6.221425 2a00:1450:4007:802::101f -> 2001:980:5354:3:fa1e:dfff:fed8:8748 HTTP 721 HTTP/1.1 200 OK  (text/html)
$

Do you have the following settings:

IP checksum checking disabled
TCP checksum checking disabled
Full packets, so captures with no snaplength
TCP reassembly enabled
HTTP reassembly enabled