This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Should size of file increase when saved on disk after extracting from packets

0

I captured a JFIF image packet of 2817 Bytes. Out of which image was of 2497 Bytes. By using option "export selected packet bytes" in wireshark, i extracted the file to my disk. The disk size is also 2497 bytes. Should not it expand as in network transmission it was compressed by GZIP. How the size is still the same after decompressing it.

Or if it is not decompressed at all?

following is the request responce block ...

GET /vi/tN23KfbtMIA/default.jpg HTTP/1.1 
Host: i1.ytimg.com 
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.2.18) Gecko/20110614 Firefox/3.6.18 ( .NET CLR 3.5.30729; .NET4.0E) 
Accept: image/png,image/*;q=0.8,*/*;q=0.5 
Accept-Language: en-gb,en;q=0.5 
Accept-Encoding: gzip,deflate 
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 
Keep-Alive: 115 
Connection: keep-alive 
Referer: http://www.youtube.com/watch?v=ERTcZV7uTFU&feature=aso

HTTP/1.1 200 OK Content-Type: image/jpeg Last-Modified: Thu, 01 Jan 1970 00:21:46 GMT Date: Wed, 27 Jul 2011 10:46:19 GMT Expires: Wed, 27 Jul 2011 16:46:19 GMT X-Content-Type-Options: nosniff Server: sffe Content-Length: 2497 X-XSS-Protection: 1; mode=block Cache-Control: public, max-age=21600 Age: 19895

========================================

asked 28 Jul ‘11, 07:08

Arjun's gravatar image

Arjun
20224
accept rate: 0%

edited 28 Jul ‘11, 11:08

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245


One Answer:

0

No, the file size should be the same. As in this case, you talk about gzip, but the object is JPEG compressed (image) data. What you're seeing is the indication of the capability of the client to accept gzip encoded (compressed) data. It's then up to the server to decide to take the client up on its offer, or not. In this case it makes little sense, so the server chooses not to gzip the JPEG compressed data.

answered 28 Jul '11, 07:55

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Thanks Jaap..

If I take raw bits and save it with extension JPEG will it make an image? This can be done by writting binary data thru C program ...what u suggest?

Thanks, Arjun

(28 Jul '11, 08:17) Arjun

(I converted your "answer" to a "comment", see the FAQ for details on how to use this site best)

(28 Jul '11, 11:09) SYN-bit ♦♦

Yes, you can do that through a program after saving "selected packet bytes", however, you can also use "File -> Export -> Objects -> HTTP" :-)

(28 Jul '11, 11:11) SYN-bit ♦♦