我最近发布了一个StackOverflow 悬赏,用于确定是 Wireshark、Firefox 还是错误的数据样本,根据最新的 Wireshark 无法解析它的事实来判断。这是问题的延续。
假设上面链接的赏金是正确的,这里是 Wireshark 无法解析的完整 SYN_STREAM SPDY 数据包:
800300010100015500000001000000004000783fe3c6a7c2003b01c4fe00000009000000073a6d6574686f6400000003474554000000053a70617468000000012f000000083a76657273696f6e00000008485454502f312e31000000053a686f73740000000d3139322e3136382e302e313734000000073a736368656d650000000568747470730000000a757365722d6167656e74000000414d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a33302e3029204765636b6f2f32303130303130312046697265666f782f33302e30000000066163636570740000003f746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380000000f6163636570742d6c616e67756167650000000e656e2d55532c656e3b713d302e3500000003646e740000000131000000ffff
根据 Wireshark 的说法,压缩的标头应以“783f”开头。不幸的是,我无法解压缩它:
$ python
Python 2.7.8 (default, Nov 10 2014, 08:19:18)
[GCC 4.9.2 20141101 (Red Hat 4.9.2-1)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import zlib
>>> header = "783fe3c6a7c2003b01c4fe00000009000000073a6d6574686f6400000003474554000000053a70617468000000012f000000083a76657273696f6e00000008485454502f312e31000000053a686f73740000000d3139322e3136382e302e313734000000073a736368656d650000000568747470730000000a757365722d6167656e74000000414d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a33302e3029204765636b6f2f32303130303130312046697265666f782f33302e30000000066163636570740000003f746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380000000f6163636570742d6c616e67756167650000000e656e2d55532c656e3b713d302e3500000003646e740000000131000000ffff".decode('hex')
>>> zlib.decompress(header)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
zlib.error: Error 2 while decompressing data
它真的是zlib吗?我怎样才能证明呢?