Wireshark-users: [Wireshark-users] Decoding XML within "chunked" HTTP 1.1 packets

From: <christopher.nemec@xxxxxxxxx>
Date: Tue, 3 Oct 2006 16:08:19 +0200

Hello Group!

I've been struggling to decode the XML content within captured packets. I am not sure whether my attached ".cap" file will be available to you, but i would appreciate any help.
The file contains short parts of the communication of our self developped application. Frame #12 is the request packet (containing XML) which is being decoded properly. Frames 14-16 are the request-response, however Whireshark does not decode the XML structure within frame 15.
Here are my settings:
a) decode traffic to port 7003 (bidirectional) as HTTP
b) following checkmarks are set: "Edit-Preferences-Protocols-HTTP: ALL checkmarks set; alternate TCP Port 7003
c) Edit-Preferences-Protocols-TCP: ALL checkmarks set
d) Edit-Preferences-Protocols-XML: "use heuristics" checkmark is set

I have tried multiple combinations of setting and un-setting the checkmarks mentioned above, but the XML content within frame # 14 remained unrecognized.

Maybe our Apache webserver (or the underlying self-developped software) transmits the response packets not according to proper HTTP 1.1 standards. On the other hand it might be a misconfiguration of Wireshark.

Any input? Suggestions? Would highly be appreciated!
Christopher

Attachment: allpackets.cap
Description: Binary data