I recently posted a StackOverflow bounty related to figuring out whether it is Wireshark, Firefox or just the data sample that is wrong, judging by the fact that latest Wireshark cannot dissect it. This is a continuation of the question.Assuming that the bounty linked above is correct, here is the full SYN_STREAM SPDY packet that Wireshark cannot dissect:800300010100015500000001000000004000783fe3c6a7c2003b01c4fe00000009000000073a6d6574686f6400000003474554000000053a70617468000000012f000000083a76657273696f6e00000008485454502f312e31000000053a686f73740000000d3139322e3136382e302e313734000000073a736368656d650000000568747470730000000a757365722d6167656e74000000414d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a33302e3029204765636b6f2f32303130303130312046697265666f782f33302e30000000066163636570740000003f746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380000000f6163636570742d6c616e67756167650000000e656e2d55532c656e3b713d302e3500000003646e740000000131000000ffffAccording to Wireshark, the compressed header should start at 783f. Unfortunately, I cannot decompress it:$ pythonPython 2.7.8 (default, Nov 10 2014, 08:19:18) [GCC 4.9.2 20141101 (Red Hat 4.9.2-1)] on linux2Type help, copyright, credits or license for more information.>>> import zlib>>> header = 783fe3c6a7c2003b01c4fe00000009000000073a6d6574686f6400000003474554000000053a70617468000000012f000000083a76657273696f6e00000008485454502f312e31000000053a686f73740000000d3139322e3136382e302e313734000000073a736368656d650000000568747470730000000a757365722d6167656e74000000414d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a33302e3029204765636b6f2f32303130303130312046697265666f782f33302e30000000066163636570740000003f746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380000000f6163636570742d6c616e67756167650000000e656e2d55532c656e3b713d302e3500000003646e740000000131000000ffff.decode('hex')>>> zlib.decompress(header)Traceback (most recent call last):  File <stdin>, line 1, in <module>zlib.error: Error 2 while decompressing dataIs it actually zlib? How can I prove it?
How to verify if Firefox is actually sending zlib data over SPDY?
decompress;https protocol