Dave Humes said:
> I"m having some difficulty using Ethereal to decompress gzip compressed
> http data. I have both Uncompress entity bodies and Reassemble chunked
> transfer-encoded bodies checked for the HTTP preferences. But if I follow
> a tcp stream with gzip encoded data, it displays the compressed data.
> Does Ethereal only do the decompression when it's capturing data?
No, but it *does* only do the decompression when dissecting packets, not
when constructing the "Follow TCP Stream" window. The "Follow TCP Stream"
window shows the raw TCP payload; no dissection is done on it, and that
includes decompression of *pieces* of it (ungzipping the whole thing won't
work, as some of it isn't gzipped, e.g. the HTTP headers).
> If so, that would be a real limitation.
If the way "Follow TCP Stream" works with HTTP connections that include
gzipped data is a limitation, it's a limitation inherent in the way it
works.
However, it's limited in other ways - it's not very helpful for binary
protocols, either. That limitation is also inherent in the way it works.
What might be more useful - although perhaps not as a *replacement* for
the current "Follow TCP Stream", but as an *additional* piece of
functionality - would be something to put into a new window the text from
the *dissection* of the data in a stream, with the coloring for the two
sides of the connection done as it is for "Follow TCP Stream".