in reply to Re^2: Extract chunked/gzip data from pcap file
in thread Extract chunked/gzip data from pcap file
Most likely, you will need to reassemble the TCP frames into the complete TCP message, then parse the HTTP response from that, and then decode the payload of the HTTP response. This is something I've done with Sniffer::HTTP, which gices you a HTTP::Response object for each completed request. You can then query the ->decoded_content method of HTTP::Response to get the uncompressed data out.
Note that I have at least one report of Sniffer::HTTP having a memory leak, so be sure to test the memory requirements before rolling it out on a large scale. Unfortunately, Net::Pcap doesn't currently build for me on Win32, so I can't conveniently replicate the environment to actually test things.
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re^4: Extract chunked/gzip data from pcap file
by oakb (Scribe) on Jan 04, 2010 at 16:19 UTC | |
by Corion (Patriarch) on Jan 04, 2010 at 16:22 UTC |