httpnetwork-programmingwiresharkwireshark-dissector

Guidance: how to view de-compressed gzipped XML data in HTTP body

We have a server that sends an HTTP Post response to my client, and the body of this POST response is an XML data that has been gzipped.

In Wireshark, we can view the original XML data by following the HTTP stream. However, I was wondering if it's possible to view the decompressed XML fields directly in the Details Panel under the Media Type subtree. (In the screenshot, notice how Media Type only shows Media type: application/gzip (28040)).

To do this, I'm wondering whether to:

  1. Write a subdissector to handle only HTTP bodies. However, it doesn't seem possible to get the original http dissector to call this subdissector

  2. Write a dissector that wraps over the original dissector. However, this requires reassembling HTTP

  3. Is there some hidden feature for Wireshark to automatically decompress and show the xml data?

Thanks!

enter image description here

Solution

  • Creds goes to Christopher Maynard for suggesting this.

    The problem happens because the XML subdissector isn't being called by the HTTP dissector. To get the HTTP dissector to call it, change the Content-Type header from application/gzip to text/xml.