Network Analysis - Rebuilding Chunked gzip HTTP from TCP

Group the segments from source port 80 by TCP sequence number. Segments with the same number are identical retransmissions, so keep one and concatenate them in ascending order

The rebuilt bytes contain two responses. The first has a Content-Length, and the KINOCO{status_is_not_secret} inside it is a decoy

Chunked encoding repeats hex length + CRLF + data + CRLF and ends with length 0. Join only the data and expand it with gzip.decompress