This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I know it is an old post, but I need to know if there is a way to tell from wireshark what the content encoding is? How should I know if it is gzip encoded? Is it in the TCP header somewhere?

asked 07 Nov '13, 09:23

doodlekana's gravatar image

doodlekana
11112
accept rate: 0%

converted to question 07 Nov '13, 15:13

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237

I converted your comment to a question, as your question is not related to the content of the original question: http://ask.wireshark.org/questions/6598/how-to-decompress-gzipped-contents

(07 Nov '13, 15:14) Kurt Knochner ♦

How should I know if it is gzip encoded? Is it in the TCP header somewhere?

No, it's not in the TCP header it's in the HTTP header. The HTTP header is called Content-Encoding. If there is compressed content, the value of Content-Encoding will be gzip (or any other supported compression method).

You can use a Wireshark display filter for that:

http.content_encoding == "gzip"

This will show frames with compressed HTTP content.

Regards
Kurt

permanent link

answered 11 Nov '13, 07:26

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×293
×9
×6

question asked: 07 Nov '13, 09:23

question was seen: 12,270 times

last updated: 11 Nov '13, 07:26

p​o​w​e​r​e​d by O​S​Q​A