Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am looking for a tool for osx, that can convert this raw data in some readable format. Testing my wifi network, I began sniffing my packets, and ran

tcpflow -i en1 -c

I want to get the sniffed html page in a readable format (with tags and so...). How can I do that, knowing I got the following non readable text running the above command ?

    213.186.033.017.00080-134.157.088.205.52899: HTTP/1.1 200 OK
Set-Cookie: mediaplan=R3058704879; path=/; expires=Tue, 04-Jun-2013 13:20:20 GMT
Date: Tue, 04 Jun 2013 12:15:48 GMT
Server: Apache/2.2.X (OVH)
X-Powered-By: PHP/5.4.6
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-cache
Pragma: no-cache
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 13274
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8

...........}.n.G.......-.i.......A..E..8.......]...Rue..MR...u?a.]@8/k...t.f..?./....kW.M.....a.U......'..r.....;>`.h...........j....j...g.~.....4..U..PFRy.m....Xm.E.f.uzz.<.5U0l.z.:..:X..iE..M'rj;K....n<.^..0Po.....`...+.g.YT.......@B.C.E.9.{.H...~.....w..kB.[....].A...N...f.h....oE..G........FJ....;o..D....T....A.T.T.o.@...m.........RC.q..P(.._..X...N....q.....@............o.E?zr.BW:"......W.@....,..s.~.s..0P..ln..~.'..g.m.o$.\...(...U........g....kc x..UM$_.k!..+.*.$_.ka.....|...Y....WQ..W.....m.Y..Tt......?..p.]...V..9..V.
6.....r/y.9R..a>....W{[......!......T ..7.t.....~.X......b+..M[...9iJhfO..I
..r......8.........1..........@..6X..6...'p.^..U..|+.`..7.n.^qe3..).....F.N....:..t.d<..MnGr"*>.h..<@....(;..^..?..Q.y.........'..A...
h..A....
213.186.033.017.00080-134.157.088.205.52899: V.)....s..af.|.......O..C&.....n ..`O.;...y..0O+...n.$ry..........bHq6;...L6...V..
213.186.033.017.00080-134.157.088.205.52899: .....G,......Os.<Y..+......5.p]...-._.7yw-....a.(............C9....b."D..f.l..w...%..$....j.O..U.............I...>...U.l....Q.N.R..#M......Rw.v*!...5......p6$rW...8...F:.K..tu..{......o.O2......Yl..........?....._.U...... ~~p...F.bu9.#...j..U.o5.I.V.$(.
.0..../..._.....'D...c7...Hp.E....K......`A..q.a..J...A.M.S.*0.Fh#@....>m.....ef..

Btw, I get the same non readable text when I use wireshark's tcp stream utility

share|improve this question

closed as off topic by Terry Chia, NULLZ, Adnan, Noordung, AJ Henderson Jun 11 '13 at 13:57

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Try wireshark, it will decipher a lot of you. Even uncompress the compressed HTML. read: en.wikipedia.org/wiki/HTTP_compression –  Stolas Jun 11 '13 at 12:01
    
@Stolas, I launched wireshark and I still have the same non readable content (when following a tcp stream, I am asked to choose between ascii, hex...). How can I use wireshark in a better way ? Btw, I retrieved my content and put it in a .zip format and tried to unzip it, it didn't work either. Could you help please ? –  beni-oui Jun 11 '13 at 12:20
    
On a totally different subject. Is that a cancerous growth in the left lung in the CT scan in your avatar? –  Adnan Jun 11 '13 at 12:30
    
@Adnan no it is the heart ;) and on the right handside (CT scan needs to be seen by inferior sight) there is the upper side of the liver –  beni-oui Jun 11 '13 at 12:37

1 Answer 1

tcpflow is doing what it is meant to do, dumping the conversations. However, if the conversation does not contain raw HTML, then the dump won't be raw HTML.

In the first example you gave, we can see that the conversation is between 54.236.2.131 using port 443 and 134.157.88.205 using port 56560. Port 443 is the giveaway: this is not a HTTP conversation, but an HTTPS conversation. It's encrypted, and that's why you can't read it. That's the point.

In the second example you gave, the server and client are using HTTP compression to save bandwidth. The server has gziped the HTML file before sending it, and the client is ungzipping it.

You mention in a comment that you've tried unzipping the body, but gzip is not the same format as zip, so that won't work. If you are using a recent version of tcpflow the -AH option should dump the body as a gzip file; a mac can extract those natively.

share|improve this answer
    
Thank you for you response, but I updated my post with a http conversation, and I still have the same issue... –  beni-oui Jun 11 '13 at 12:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.