Wireshark-users: Re: [Wireshark-users] Decoding XML within "chunked" HTTP 1.1 packets

From: LEGO <luis.ontanon@xxxxxxxxx>
Date: Tue, 3 Oct 2006 15:39:00 +0100

the decoded output happens to be on frame 16... where the stream was
defragmented.

L

On 10/3/06, christopher.nemec@xxxxxxxxx <christopher.nemec@xxxxxxxxx> wrote:

Hello Group!

I've been struggling to decode the XML content within captured packets. I am not sure whether my attached ".cap" file will be available to you, but i would appreciate any help.
The file contains short parts of the communication of our self developped application. Frame #12 is the request packet (containing XML) which is being decoded properly. Frames 14-16 are the request-response, however Whireshark does not decode the XML structure within frame 15.
Here are my settings:
a) decode traffic to port 7003 (bidirectional) as HTTP
b) following checkmarks are set: "Edit-Preferences-Protocols-HTTP: ALL checkmarks set; alternate TCP Port 7003
c) Edit-Preferences-Protocols-TCP: ALL checkmarks set
d) Edit-Preferences-Protocols-XML: "use heuristics" checkmark is set

I have tried multiple combinations of setting and un-setting the checkmarks mentioned above, but the XML content within frame # 14 remained unrecognized.

Maybe our Apache webserver (or the underlying self-developped software) transmits the response packets not according to proper HTTP 1.1 standards. On the other hand it might be a misconfiguration of Wireshark.

Any input? Suggestions? Would highly be appreciated!
Christopher



_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users

--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan