How to decode HTTP2 DATA stream

  • retag add tags

Hello Folks,

I have captured HTTP2 packets and decoded it as HTTP2. While my DATA payload is application/json form , how i can view it in application/json format.

Looks like it is due to compression. If i run and capture single http2 then i can see payload in json format, if i run it in bulk request i am not able to see it in json format

Kindly help

electronics.sunny@gmail.com's avatar
1
[email protected]
asked 2020-05-08 06:40:53 +0000, updated 2020-05-08 06:43:20 +0000
edit flag offensive 0 remove flag close merge delete

Comments

Can you share an example pcap?
If you follow the TCP stream, does the last packet show the Reassembled body?

Chuckc's avatar Chuckc (2020-05-08 16:13:21 +0000) edit
more
  • delete

Hi,

I have the same issue - and as far as I see, tshark not decoding the data is because the pcap does not include the connection setup. Would appreciate support as well in finding a solution.

Thanks, Octavian.

OctavianD's avatar OctavianD (2020-05-14 07:31:20 +0000) edit
more
  • delete

Hi, In the development version you can use "decode as" and select JSON which workls in some cases but I think code changes are needed. I have suggested these changes to the support library used to decode http2 https://github.com/nghttp2/nghttp2/pu...

Anders's avatar Anders (2020-05-14 10:15:50 +0000) edit
more
  • delete
add a comment see more comments