HTTP2 stream and data not decoded

asked 2020-05-14 07:36:21 +0000

OctavianD gravatar image

updated 2020-05-14 08:04:47 +0000

grahamb gravatar image

Hi,

I have this pcap where I capture HTTP2 messages for a connection that is already established when I start the tcpdump.

In the wireshark, the data and headers are not decoded. Is there any way to have wireshark decode it, even if the pcap is missing the connection setup?

Thanks Octavian.

edit retag flag offensive close merge delete

Comments

Hi, Not without code changes. I have suggested these cahnges to the support library used to decode http2 https://github.com/nghttp2/nghttp2/pu...

Anders gravatar imageAnders ( 2020-05-14 09:52:30 +0000 )edit

Hi Anders, meanwhile is there a way for me to get the http2 path, from an existing packet, not decoded in a pcap file?

for example:

0000 00 00 5e ff 00 03 d2 58 0e dc ec a2 08 00 45 00 ..^....X......E. 0010 00 92 c9 ee 40 00 3f 06 a2 0e 0a 61 51 a7 0a 61 ....@.?....aQ..a 0020 69 00 a8 24 00 54 f3 98 71 4b 3e 7e fb 46 80 18 i..$.T..qK>~.F.. 0030 01 f5 68 df 00 00 01 01 08 0a 00 f3 8b 15 dc 5f ..h............_ 0040 e4 9f 00 00 55 01 04 00 00 00 05 86 44 ce 62 a1 ....U.......D.b. 0050 da 89 56 1d a9 9d 8e e1 62 d2 ac 3b 53 39 6a 49 ..V.....b..;S9jI 0060 88 34 98 f5 21 ...(more)

patrickcosta51 gravatar imagepatrickcosta51 ( 2020-08-13 14:02:20 +0000 )edit

Hi, The development version of wireshsark has a solution implemented which fixes most problems.

Anders gravatar imageAnders ( 2020-08-13 15:57:48 +0000 )edit
add a comment