Why does this happen? Careful child shoes may be found to be different from the data we send to the server for the requested connection:
The information for the first picture is {"Roomid": 98284, "UID": 271298361556770}
The information in the second picture is {"UID": 276194535568357, "Protover": 2, "Roomid": 98284}
Roomid is the real room number, UID is a randomly generated number, you can directly copy the login.
In contrast, the second one has more "Protover": 2 parameters. In fact, the first picture is to crawl the mobile phone client packet, the second picture is to crawl the computer Web page data packet. So there is no this "protover": 2 This parameter can be connected to the Bomb screen server.
So we can infer that the most easy-to-grasp data is the mobile phone, followed by the WAP end, the end is the computer.
But a lot of time we grab the packet data is a string of two of garbled characters, whether you use UTF8 or GBK code can not reach the effect of figure one.
This data is actually a compressed data gzip, currently Wireshark does not support this compression data decompression mode.
Now the Web site in the transmission is basically the compression mode for transmission, so you crawl the data is compressed data, in your opinion is thorough the bottom of the garbled, do not know.
, access to my blog home page, crawl server sent back the Web data is gzip mode, and we usually visit the page is the browser extracted data and rendering and then presented to us.
Since the analysis of the beep of the server is the gzip data, then the solution is very simple, install a third-party zlib package or gzip package can solve the problem.