I took a pcap trace when accessing a we开发者_如何学Gobsite using Opera Mini on my mobile, and as Opera Mini uses a socks proxy to tunnel http traffic, the wireshark trace shows most of the packets as socks packets. Is there a way to extract the http payload from this?
Once a SOCKS connection has been established and authenticated, all exchanged data afterwards on that same connection is the HTTP data. Locate the first data packet after the SOCKS handshake is complete and tell Wireshark to decode it and all subsequent packets as HTTP instead of SOCKS.
精彩评论