{"action":"created","issue":{"url":"https://api.github.com/repos/simsong/tcpflow/issues/54","labels_url":"https://api.github.com/repos/simsong/tcpflow/issues/54/labels{/name}","comments_url":"https://api.github.com/repos/simsong/tcpflow/issues/54/comments","events_url":"https://api.github.com/repos/simsong/tcpflow/issues/54/events","html_url":"https://github.com/simsong/tcpflow/issues/54","id":18834354,"number":54,"title":"Unnecessary chunked HTTP header & footer remains in the output flow","user":{"login":"pi3ch","id":803315,"avatar_url":"https://avatars.githubusercontent.com/u/803315?v=3","gravatar_id":"","url":"https://api.github.com/users/pi3ch","html_url":"https://github.com/pi3ch","followers_url":"https://api.github.com/users/pi3ch/followers","following_url":"https://api.github.com/users/pi3ch/following{/other_user}","gists_url":"https://api.github.com/users/pi3ch/gists{/gist_id}","starred_url":"https://api.github.com/users/pi3ch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pi3ch/subscriptions","organizations_url":"https://api.github.com/users/pi3ch/orgs","repos_url":"https://api.github.com/users/pi3ch/repos","events_url":"https://api.github.com/users/pi3ch/events{/privacy}","received_events_url":"https://api.github.com/users/pi3ch/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2013-09-01T09:12:45Z","updated_at":"2015-09-01T11:26:36Z","closed_at":null,"body":"tcpflow leaves \"Chunked HTTP transfer encoding\" headers and footers in the output file. This is quite annoying as it leaves garbage data in the flow and a file carving tool like foremost does not ignore them. If your binary splits into for example three chunks, tcpflow output file leaves three instances of following pattern in the output.\r\n\r\n**0D 0A SIZE_OF_CURRENT_CHUNK_IN_HEX 0D 0A**\r\n\r\n_Initial CRLF is from end of previous chunk._\r\n\r\nAs an example, use http://forensicscontest.com/contest05/infected.pcap (From Forensic Contest Puzzle 5)  generate the flow and try to extract the binary file using foremost (dst port 1066). The final binary will not have correct checksum. NetworkMinner does extract the original binary without any garbage.\r\n\r\nI tried this using tcpflow in the debian repository or the complied version off from github (v1.3 - v1.4). \r\n\r\np.s. some may say this is an issue with the file carving tool, however, tcpflow shouldn't leave unnecessary chunk data in the final flow."},"comment":{"url":"https://api.github.com/repos/simsong/tcpflow/issues/comments/136679060","html_url":"https://github.com/simsong/tcpflow/issues/54#issuecomment-136679060","issue_url":"https://api.github.com/repos/simsong/tcpflow/issues/54","id":136679060,"user":{"login":"simsong","id":1594284,"avatar_url":"https://avatars.githubusercontent.com/u/1594284?v=3","gravatar_id":"","url":"https://api.github.com/users/simsong","html_url":"https://github.com/simsong","followers_url":"https://api.github.com/users/simsong/followers","following_url":"https://api.github.com/users/simsong/following{/other_user}","gists_url":"https://api.github.com/users/simsong/gists{/gist_id}","starred_url":"https://api.github.com/users/simsong/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simsong/subscriptions","organizations_url":"https://api.github.com/users/simsong/orgs","repos_url":"https://api.github.com/users/simsong/repos","events_url":"https://api.github.com/users/simsong/events{/privacy}","received_events_url":"https://api.github.com/users/simsong/received_events","type":"User","site_admin":false},"created_at":"2015-09-01T11:26:36Z","updated_at":"2015-09-01T11:26:36Z","body":"So it is. Would you like to submit a patch?"}}