7

I want to monitor all HTTP traffic to one of my localhost websites that I am running in the Visual Studio debugger, which hosts the website on IIS Express, while my debugging session is in progress.

I've been using Fiddler for many years now, along with developer tools on most popular browsers. However, all these are proxies for browsers. They do not capture activity between a different type of client other than a browser and a website. For e.g. if I have a .NET MVC application sending an HTTP request using the System.Net.HttpClient class to a ASP.NET Web API, both hosted on the same computer, Fiddler does not capture that traffic, and for obvious reasons, neither do any of the browsers because they are not involved in that request.

I want to capture all HTTP traffic (requests and responses) from any kind of a client to one of my websites hosted on localhost.

Can I do something to make Fiddler do that? Alternatively, is there a free tool that'll help me do that?

  • You probably mean Windows? If yes, please add a tag. – Smit Johnth Aug 23 '14 at 6:10
  • Have you looked into wireshark? Not sure if it will offer what you after. – Grady D Aug 25 '14 at 4:14
  • From my understanding, the issue isn't WinPCAP, but rather how the Windows network stack handles loopback traffic. – MrSchism Aug 25 '14 at 15:11
  • @MrSchism it's still WinPCAP's problem. – Smit Johnth Nov 24 '14 at 10:37
  • I used Commview but it's not free ;( – Smit Johnth Nov 24 '14 at 10:38
4

There's a good blog post located here that describes using netcat, wireshark, and PowerShell scripts to forward localhost traffic to your default gateway and back.

An apparent caveat is that it may cause you to see double traffic (outbound and inbound). The solution is to change your capture filter accordingly.

If I were capturing on my local system, I'd go with

http and ip.src==192.168.1.2

(but obviously using your computer's IP). That would show only the HTTP packets leaving your computer. That should reduce the number of packets as opposed to capturing them on the return (dst.ip) which would also show any websites you were browsing.

2

Maybe you want to look into Wireshark.

Wireshark is a free tool for network monitoring. It monitors the complete traffic from your network interface (including all protocols ARP/TCP/etc.), but you can filter the traffic to only see all http requests and responds.

  • The filter to view only HTTP is HTTP (people often miss it, to be honest). – MrSchism Aug 25 '14 at 14:31
  • 1
    Wireshark uses WinPCAP (AFAIR Fiddler uses it too) which is the only sniffer library I know that is unable to sniff localhost traffic on windows. They claim "windows is bad" in their FAQ. Funny, any other sniffer works. Oh, I already commented this :) – Smit Johnth Nov 24 '14 at 10:35
0

Here's a .NET library for that called RunscopeMessageHandler. Project on GitHub and a more info on .NET HTTP debugging over here. You'll need a free Runscope account. It's a great way to capture all of the HTTP traffic initiated from your client -- request, response, URI, headers, etc. It's all indexed, searchable, and presented very cleanly.

0

Please try Npcap: https://github.com/nmap/npcap, it is based on WinPcap and supports loopback traffic capturing on Windows. Npcap is a subproject of Nmap (http://nmap.org/), so please report any issues on Nmap's development list (http://seclists.org/nmap-dev/).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.