How to analyze a single http2 packet saved in a pcap file?

asked 2021-03-02 17:03:12 +0000

updated 2021-03-02 17:18:18 +0000

cmaynard gravatar image

Hi, I have a pcap file about an http2 stream captured with wireshark. The problem is when I see the packets in real time I can see al the info of decripted packet while if I save it in a pcap file and try to analize later some packet I cannot see it anymore. If I just want to analize a single http2 packet , so the entire session, is there a way to see the infos?

Is there a way to analize a single packet without all flow e without consider all previous packets ? For what I have understood the problem is related to dynamic table population. Is there a way to save also info about dynamic table or a way to give it some info about dynamic table?

edit retag flag offensive close merge delete

Comments

Other than doing decode as for a http2 stream there is no way to populate the dynamic tables.

Anders gravatar imageAnders ( 2021-03-02 19:02:53 +0000 )edit

ok but why i cannot see decoded info when i open the pcap file of just a piece of stream or just one packet? So basically I con only see http2 decoded data in real time because pcap file are useless . Is there a way?

kenhero gravatar imagekenhero ( 2021-03-02 20:52:45 +0000 )edit

Probably because the information needed to decode the packet(s) isnt present in the trace if some part of the stream is missing.

Anders gravatar imageAnders ( 2021-03-02 20:58:05 +0000 )edit

right. Is there a way to save all infos for cpap file or another format to save all data? Thank you

kenhero gravatar imagekenhero ( 2021-03-02 22:02:43 +0000 )edit

No currently not.

Anders gravatar imageAnders ( 2021-03-03 04:37:07 +0000 )edit