The urldecode function has issues with certain characters, so many of them need to be escaped (specifically any with hex starting with 0, 1, 8, 9, or any letter...). I built this eval statement that can be used as a calculated field:
urldecode(replace(replace(substr(packet, -packet_len*2), "([A-Fa-f0-9][\d\w])", "%\1"), "%[\D0-18-9]\w", "."))
... View more