in reply to Re^2: Extract chunked/gzip data from pcap file
in thread Extract chunked/gzip data from pcap file

Most likely, you will need to reassemble the TCP frames into the complete TCP message, then parse the HTTP response from that, and then decode the payload of the HTTP response. This is something I've done with Sniffer::HTTP, which gices you a HTTP::Response object for each completed request. You can then query the ->decoded_content method of HTTP::Response to get the uncompressed data out.

Note that I have at least one report of Sniffer::HTTP having a memory leak, so be sure to test the memory requirements before rolling it out on a large scale. Unfortunately, Net::Pcap doesn't currently build for me on Win32, so I can't conveniently replicate the environment to actually test things.

Replies are listed 'Best First'.
Re^4: Extract chunked/gzip data from pcap file
by oakb (Scribe) on Jan 04, 2010 at 16:19 UTC

    I can't get Sniffer::HTTP to install on Win32 ActivePerl. From the sound of it, I might be better off not installing it anyway. Of course, I have HTTP::Response as part of my default installation. Is there any way to create an HTTP::Response object without Sniffer::HTTP?

      Likely by doing what Sniffer::HTTP does. Or by looking at HTTP::Response, and then using its methods and the data you glean from the packet stream to fill in the object. Which is what Sniffer::HTTP does.