How to decompress gzipped http packet's response body ?

[ugr...@gmail.com]

Hi there,
I'm writing a module, which is sniffing ethernet traffic on Http protocol and i can get request and response packets all rest apis, but i get some problems about gzipped rest services(GET, POST) decompressing time. For example my get request service normally return following json data at body part:

[
{
"questionId": 684,
"groupName": null,
"screenId": "ACHTPRCK",
"yetEkranAd": null,
"question": "Para çekme işleminde döviz cinsinden çekmek mümkün mü?",
"answer": "pek bilgim yok açıkçası",
"description": "güzel cevap",
"finartUser": null,
"recordDate": null,
"status": null,
"validityStartDate": null,
"validityendDate": null,
"groupId": 0
}
]

But response body part always get 15 length byte array:

{97, 13, 10, 31, 139, 8, 0, 0, 0, 0, 0, 4, 0, 13, 10}

first three byte added by network layer i think that means messages length. 31 and 139 are gzip compress flags and following related with gzip too. i do not understand last two bytes 13 and 10 when i decompress this 15 byte it returns empty string to me.

It is very important for us, how can i resolve this gzipped data from captured packet ?

[ugr...@gmail.com]

Content-Encoding: gzip

this encoding type is get too problem for decoding type, can anyone help us ?

[Boaz Brickner]

Can you provide an example .pcap file?

[ugr...@gmail.com]

Hi Boaz my packet is chunked that contains fragments and, partial data compressed by gzip. I need sample code for combine fragment data and decompress it.

[ugr...@gmail.com]

I send request and capture the packet response. Basically my response message body part contains simple text = "ugur"

"ugur" is equals to [117,103,117,104] for byte array form after gzip compression byte array now so complexier than first version

[31,139,8,0,0,0,0,0,40,43,77,47,45,2,0,180,207,126,220,4,0,0,0] 24 length.

I want to handle this gzip compressed result message in packet. I know that, need to combine fragments and payloads, but i can not combine each of them. How can i get http response part please help us!

[Boaz Brickner]

If you need help with that it's best if you provide a .pcap file example.