I'm trying to guess the communication protocol between a program and a webserver. I've already captured the packets and gotten the Ethernet, IP and TCP layers, and now I want to make sense of the payload. It makes no sense in ASCII.
I'm reasonably sure the payload is not encrypted, and I'm guessing it's mainly compressed in some way. I'm also guessing it's something fairly mainstream and something that was available years ago already. And once I guess this layer, I'm pretty sure the rest is near to ASCII.
I've tried clicking through a number of the Transport decoders in Wireshark, but I don't really know what to look for. I've also tried saving the first packet and decoding it with gzip.
This is nothing naughty. I can already see the data in the program itself, and I just want to write a program of my own to automatically pick out some data and enrich it in order to automate some tedious tasks.
Does anybody have some general pointers?
I attach a couple of lines of payload starting with the first 1452-byte packet which is the first non-zero payload received.
Thanks for any ideas, Soren
00000000 0e 3c 0f 7a 78 9c 8d 58 89 7f 1b b7 95 d6 88 b6 .<.zx..X ........
00000010 63 ca 76 e4 a6 4d 76 d3 dd 3a e3 36 69 e2 c6 b6 c.v..Mv. .:.6i...
00000020 38 a4 48 91 6e 95 ac 25 4b 89 37 4e ec 48 4e d2 8.H.n..% K.7N.HN.
00000030 64 0f 16 33 03 ce 80 83 01 c6 c0 80 e4 b0 ad bb d..3.... ........
00000040 f7 d5 a6 f7 5e bd bb db 63 ff cc 7d ef 41 4a f2 ....^... c..}.AJ.
00000050 4b 6b ed ca 96 08 0c 80 ef 5d df 7b 78 c3 b3 57 Kk...... .].{x..W
00000060 d7 eb d5 a8 db db 1c b4 3b 6d a7 12 c9 a7 3a 57 ........ ;m....:W
00000070 db fb ed 34 36 5c 29 6e 60 68 13 5d d7 0d 0c ca ...46\)n `h.]....
00000080 dc 4e 39 7c 26 da 4d b5 8b 46 5b 5d 98 14 ce d4 .N9|&.M. .F[]....
00000090 92 a9 0c 86 2c 36 2c cb 70 87 e4 33 81 28 31 33 ....,6,. p..3.(13
000000A0 8a d7 16 f1 78 6c b4 c5 b5 e9 44 bb 1a d1 78 c8 ....xl.. ..D...x.
000000B0 4c c6 15 8e 6d 29 6c 25 10 c2 94 fe a0 64 29 27 L...m)l% .....d)'
000000C0 80 d8 26 39 0c 26 ce 22 4c ce 65 29 32 a3 61 58 ..&9.&." L.e)2.aX
000000D0 f1 9a 1b dc 33 d7 72 c2 49 67 16 3b 83 03 ae 0b ....3.r. Ig.;....
000000E0 52 c2 2a c1 70 64 99 4a 72 4d 03 67 c8 a6 94 cb R.*.pd.J rM.g....
000000F0 09 09 ca 78 c9 a5 44 d1 86 0b 2b d0 8c 89 30 3c ...x..D. ..+...0<
00000100 c9 05 9f a0 10 7d 0d c5 4e 99 2a 71 0b 13 e0 12 .....}.. N.*q....
00000110 54 a7 64 26 66 a4 98 aa 67 e8 05 81 66 d4 42 89 T.d&f... g...f.B.
00000120 a5 26 5f d8 52 4b e9 dd 27 a4 64 13 87 a3 9a 4f .&_.RK.. '.d....O
00000130 98 92 6e 81 50 a2 20 67 68 3b 45 85 c1 2a 42 9b ..n.P. g h;E..*B.
00000140 26 25 5b 90 5c 85 1e e7 73 1e 13 c8 c4 08 9e 4a &%[.\... s......J
00000150 bf 07 1c 29 5d 22 1c 2a e6 52 ed b5 51 22 29 08 ...)]".* .R..Q").
00000160 8f c3 56 04 60 4e 26 39 b9 65 02 91 b4 24 ad 1a ..V.`N&9 .e...$..
00000170 c3 4e a9 e7 3e 88 74 b4 90 14 b0 3c 17 06 1c 4d .N..>.t. ...<...M
00000180 b1 73 69 ca bb e4 eb b2 aa c9 8f 61 21 e2 58 d4 .si..... ...a!.X.
00000190 4b 12 90 14 5c d2 f9 4c d4 9a 9b 0c 51 e2 84 91 K...\..L ....Q...
000001A0 fd ba 14 78 92 2d b8 8c 3a b8 3b 24 d7 ea 39 c2 ...x.-.. :.;$..9.
000001B0 e9 7a 9c 30 e5 bc 9e 4c 8d e1 d7 96 cc 1f e3 f8 .z.0...L ........
000001C0 b0 8c 8d 73 8a 84 30 d5 90 14 96 b2 12 0f 2b 6d ...s..0. ......+m
000001D0 62 74 48 ce a6 ba a2 cf 12 bc 49 96 4e 9d 8f 5f btH..... ..I.N.._
000001E0 26 27 5a 66 c4 d3 24 1a f5 87 28 37 6d ac e5 ce &'Zf..$. ..(7m...
000001F0 0e 46 a8 70 ce 2d c8 83 63 30 99 19 f0 25 33 e9 .F.p.-.. c0...%3.
00000200 f6 1e 38 05 1c 94 12 19 4a 5d b2 14 2d 66 d2 29 ..8..... J]..-f.)
00000210 34 c4 72 93 92 0f 97 02 15 8d 21 94 0d d0 84 1e 4.r..... ..!.....
00000220 01 c7 e1 af 60 2a ea a1 ac 82 d5 cb 92 79 1a ce ....`*.. .....y..
00000230 e9 2f c4 a4 24 d5 c7 a9 37 da 02 65 0a a2 11 50 ./..$... 7..e...P
00000240 03 57 f8 8c 09 8a 9f 28 19 d9 60 1d 4f d1 2e 84 .W.....( ..`.O...
00000250 a9 44 c2 ac d5 24 49 2d f1 33 d5 49 69 89 b3 26 .D...$I- .3.Ii..&
00000260 e6 6a 93 62 c4 96 0d f1 5a ea 82 4c b0 2c 21 8a .j.b.... Z..L.,!.
00000270 88 34 e3 b5 4e d9 11 2b 3d e9 32 c3 94 9e f1 9a .4..N..+ =.2.....
00000280 5c 00 54 80 15 e4 ea 9c d9 23 16 d5 90 0b 0b 1c \.T..... .#......
00000290 cf 98 64 68 3a 46 75 2e 64 3a 9e e7 c2 d6 64 66 ..dh:Fu. d:....df
000002A0 45 d9 97 35 a5 3a a2 ac 9e 49 12 5a b2 8c a2 67 E..5.:.. .I.Z...g
000002B0 34 b7 86 d5 b8 c6 0a 8a 10 73 85 67 22 b2 14 44 4....... .s.g"..D
000002C0 a0 2d 86 a3 6e 12 0f a6 0e a9 57 90 9b 27 13 4a .-..n... ..W..'.J
000002D0 19 88 37 fa 8e 95 5a 48 fb a1 b8 2e ed 4e 8a b4 ..7...ZH .....N..
000002E0 a0 1c 56 4a d8 02 e9 50 e8 24 af 98 2c 49 be f6 ..VJ...P .$..,I..
000002F0 f5 81 89 94 8d cb 62 ac 24 a9 cd e2 71 9f aa 06 ......b. $...q...
00000300 d4 0d 54 0a 32 51 6d a2 ac 86 d6 b5 b1 4b 67 0a ..T.2Qm. .....Kg.
00000310 47 91 b3 a1 ae 26 3e 79 4b 61 28 13 6b 08 50 c6 G....&>y Ka(.k.P.
00000320 28 89 45 36 a7 f3 b5 0f b7 1f 8c bb 23 64 41 5e (.E6.... ....#dA^
00000330 66 a8 63 15 3b 95 e2 b1 6a 82 b5 84 32 2c 84 4c f.c.;... j...2,.L
00000340 ae 21 13 71 6c c0 99 5a 20 7f ac 71 28 5f 1b 51 .!.ql..Z ..q(_.Q
00000350 87 a5 36 84 38 35 1a 3f f2 44 f5 b7 30 98 9c 39 ..6.85.? .D..0..9
00000360 f2 74 26 6c 89 a0 19 04 67 81 83 03 a8 7c 3b be .t&l.... g....|;.
asked 10 Jan '13, 13:12
shein
11●1●1●2
accept rate: 0%