I know it is an old post, but I need to know if there is a way to tell from wireshark what the content encoding is? How should I know if it is gzip encoded? Is it in the TCP header somewhere? asked 07 Nov '13, 09:23  doodlekana converted to question 07 Nov '13, 15:13  Kurt Knochner ♦ |
One Answer:
No, it's not in the TCP header it's in the HTTP header. The HTTP header is called Content-Encoding. If there is compressed content, the value of Content-Encoding will be gzip (or any other supported compression method). You can use a Wireshark display filter for that:
This will show frames with compressed HTTP content. Regards answered 11 Nov '13, 07:26 Kurt Knochner ♦ |
I converted your comment to a question, as your question is not related to the content of the original question: http://ask.wireshark.org/questions/6598/how-to-decompress-gzipped-contents