Hi everybody,
I am analyzing Pcap captures with C and I need to uncompress the Gzipped body of the HTTP replies. I know that I can do that using Wireshark manually, but I would need to do it on the fly, inside my program.
My understanding is that I should look into zlib and the RFC. But since it's a little analysis program, do you know where I could find a quick solution?
Thanks
It doesn't sound like you'll need to read any additional RFCs from what you already know. You don't need to understand the compression algorithm to use it.
Using zlib is pretty easy.
You can do this deflating within a few lines of code: Here is an example.
Probably, whatever language you're building your analysis program in, there should be a library already ready to use to decode gzip compressed streams. Google or Bing for "your-language-of-choice gzip implementation" or something alike and you'll likely get the solution for your problem.
As a last resort, you may always get your program to use GNU gzip (there must be a build for your system of choice) by feeding the data to it and using gzip's decompressed output to work on.
Solved! I found an implementation on gzip called minigzip. It's a little nice program that does the trick, i will use as a reference implementation.
Wouldn't it be simpler to run it rhough a proxy that rewrites the Accept-Encoding cleint header to Accept-Encoding: compress;q=0, gzip;q=0
?
C.