Response content when getting content-encoding:gzip in "HTTP" Wireshark

gzip format

See: Http://blog.csdn.net/jison_r_wang/article/details/52068607 is clearly stated.

Key: gzip head starts with 0x1f8b

Get compressed response data with Wireshark

My Wireshark version number is: v1.12.4

1. Select a package, right-click Follow TCP Stream

2. Select the raw below

3. Click Save As to Xxx.zip

4. Select Hex Dump to find the location of the 0x1f8b

5. Open Xxx.zip with notepad++, delete the contents of the previous 0x1f8b, save

Note: Do not use UltraEdit, I use UltraEdit when the content will be changed, originally 0x00 will become 0x20

6. Right-click Xxx.zip Unzip, then you can open to see the specific content

Response content when getting content-encoding:gzip in "HTTP" Wireshark