Ask Your Question

Why am I seeing "J%C3%A4%C3%A4kaapi" rather than "jääkaappi"?

asked 2020-09-24 08:47:56 +0000

Nordic gravatar image

updated 2020-09-24 22:26:57 +0000

Guy Harris gravatar image

Should I be able to see nordic letters in Wireshark capture?

I'm using Wireshark 2.6.3.

I'm sending a http post and I'm missing scandic letters (Ä and Ö).

The post should say "jääkaappi" but when I capture the post I see following: "J%C3%A4%C3%A4kaapin"

When using a different http post sniffer I can see the scandics.

edit retag flag offensive close merge delete


Your question is missing some context, but "%C3%A4" is the UTF-8 representation of "ä". If you post a link to a capture containing the packet at issue on a public share, e.g. Google Drive, DropBox etc. we can comment further.

grahamb gravatar imagegrahamb ( 2020-09-24 10:44:11 +0000 )edit

1 Answer

Sort by » oldest newest most voted

answered 2020-09-24 22:26:06 +0000

Guy Harris gravatar image

What you're seeing is called "percent encoding". Whatever program is sending the HTTP POST is using percent encoding, and has, for example, percent-encoded the ä character as its two-octet representation in UTF-8 (hex C3 followed by hex A4, as per @grahamb's comment), with those two octets percent-encoded.

Wireshark doesn't do percent-encoding - it's showing you what was in the packet, without percent-encoding it.

When using a different http post sniffer I can see the scandics.

Perhaps that's not a packet sniffer, so that it doesn't capture, and display, raw network packets, which is what Wireshark does. You refer to it as an "http post sniffer"; perhaps it's a proxy sniffer, and perhaps it undoes the percent-encoding to show you what the percent-encoded text represents. What sniffer is it?

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-09-24 08:47:56 +0000

Seen: 40 times

Last updated: Sep 24