This is our old Q&A Site. Please post any new questions and answers at

I have pcap files with http contents compressed by gzip, and want to export each stream to a text file. I know wireshark can export the uncompressed contents by GUI, but exporting each file manually is time wasting. I want to do this by tshark automatically.

I tried followings:

for stream in `tshark -r input.pcap -T fields -e -2 -R http | sort -n | uniq`
  tshark -q -r input.pcap -o http.decompress_body:TRUE -z follow,tcp,ascii,$stream > $stream.txt

However, "-o http.decompress_body:TRUE" does not seem to work correctly.

Any ideas?

asked 03 May '14, 22:07

hseisyu's gravatar image

accept rate: 0%

edited 03 May '14, 23:25

However, "-o http.decompress_body:TRUE" does not seem to work correctly.

the option does work, but the 'Follow TCP stream' function does not decompress the HTTP response, neither in Wireshark (GUI) nor in tshark (CLI), as that's not implemented yet. The 'Follow TCP stream' function just shows the contents of the TCP payload as it is transmitted over the wire.

There is an enhancement request:

However, a patch that implemented the feature has never been accepted due to some problems.

So, if you need to extract the HTTP payload, including uncompressed HTTP responses, your options are:

  • implement the feature yourself and submit the code
  • wait until the feature gets implemented by somebody
  • pay somebody to implement it for you
  • use a different tool, like one of those mentioned in the following questions/answers.


permanent link

answered 04 May '14, 08:57

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 03 May '14, 22:07

question was seen: 5,179 times

last updated: 04 May '14, 10:57

p​o​w​e​r​e​d by O​S​Q​A