Guest
|
 Posted: Mon Jun 16, 2008 1:15 am Post subject: Type of compression |
 |
|
Hi,
I am struggling for a few days to decompress a tcp stream. Parts of
the stream i can decompress using perl and module
IO::Uncompress::AnyUncompress. These parts which i can decompress, are
prefix with 0x7801 . So these parts are standard Zlib RC1950.
But other parts (packets) in the same stream i can>t compress. I
suspect it is compress with RFC1951 Z_HUFFMAN_ONLY but i didn>t can
decompress it.
Can somebody see what type of compression is used?
Below an example: 3c00 is the size of the package, 4c00 is the size of
the uncompressed data i guess, and i think the start of the header/
compressed data is fd4f (packages with RFC1950 start here with 0x7801)
Example tcpdump output on compressed stream:
0x0020: 5018 feaf c89c 0000 3c00 0000 4c00 0626
P.......<...L..&
0x0030: fd4f e21f df9a 7e29 ef2c c93d adca
2bc1 .O....~).,.=..+.
0x0040: adca 2bba 69df b7c5 63b6 3cc4 fdb6 3318 ..
+.i...c.<...3.
0x0050: edbe 7b9c e739 ce73 9ce7 39ce 739c e739 ..{..9.s..
9.s..9
0x0060: ce73
9ce0 .s..
Any hint will be appreciated,
J |
|
