Hi there, this might be a dumb question but it's my first time using wireshark for a project and I've been trying to follow the TCP stream of some packets. However when the dialogue box pops up, all i get is a bunch of gibberish and not in the form or format I've seen of others online even though it's in the ASCII format. Please help!
As others have indicated, not all protocols involve ASCII text.
They may be binary, in which case anything other than text strings will look like gibberish. A lot of protocols are binary.
They may be text in some form of "extended ASCII" (including UTF-8), in which case some of it will look like ASCII text but non-ASCII characters will look like gibberish; if it's text in a language that doesn't use the Roman alphabet (Greek, languages using the Cyrillic alphabet, languages using the Hebrew or Arabic alphabet, Chinese, Japanese, Korean, etc., etc., etc.), it'll look like gibberish in ASCII, but you can change the ASCII display to another encoding.
They may be text in UTF-16, which will probably have bits that look like ASCII characters with single symbols between them, and other parts that look like gibberish. You can change the ASCII display to UTF-16.
They may be text in EBCDIC, which will probably look like gibberish. You can change the ASCII display to EBCDIC.
It's possible that the tcp stream contains binary or encrypted data. What is the protocol that you're trying to display?
Which protocol is used by the TCP session you are following? Is it by any chance HTTPS over port 443? In that case, the traffic is encrypted and does indeed look like gibberish.
On the follow TCP dialog, by default is does ACSII - but there's a "show as" option which has around a dozen choices. Maybe it's EBCDIC data you've got?
Hope this helps...
Martin
Asked: 2017-11-24 15:11:16 +0000
Seen: 1,078 times
Last updated: 6 hours ago
