Simple http traffic monitor (capture by process)

Question

I know, questions like this have been asked a lot before.
I have a big problem using Wireshark because of the following reasons:

• It is not able to trace down which process sent/received a packet
• It doesn't only show HTTP traffic
• For HTTP traffic it gives me annoying tree views
• I can't start a global search on the content of all packets
  (the last point isn't that important)

What I'm looking for is a simple HTTP traffic monitor that allows me to capture the HTTP traffic of a single process, showing the raw requests like this:

POST /index.html HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0

param1=testabc&qwe=123

Timestamps and IPs would be nice as well.

I hope you can help me out. And just so that you know: I spent a lot of time on Google-ing for a monitor like this, but I couldn't find a good one.

I'm on Windows.

Solution 1

You can use Fiddler; it captures HTTP traffic and it has filters by processes.

It also has a nice display and is Windows friendly.

Solution 2

On windows, you should be able to use Microsoft Network Monitor to trace a single process. You'll want to use the ProcessName or ProcessID filters to select just the process you're interested in.

If NetMon does not return results in a format that is usable to you, then you might also try an experimental version of WireShark that adds support for pid filtering on windows.

Download: [Wireshark-dev] [PATCH] Filter by local process name

On linux, you should be able to use strace to monitor a single process, but it will likely not be formatted just the way you want. To trace an existing process:

strace -p $PID -f -e trace=network -s $MAXLEN

To strat a process with tracing:

strace -f -e trace=network -s $MAXLEN PATH/TO/PROCESS ARGUMENTS

For further info see: man strace

References: Conversation filtering and AskUbuntu capture single process

Comments

[nixda]

Does Nirsoft's NetworkTrafficView fit your needs?

[Forivin]

I forgot to say, I'm on Windows.

[ssnobody]

That does change things a bit. I've added some new info for windows. Let us know how it goes.

[Forivin]

Thanks, but I already tried the Microsoft Network Monitor. It shows the headers in unnecessary treeviews and I couldn't find the bodies.

[ssnobody]

Added some info on an experimental wireshark build that may be what your looking for...

[Forivin]

well, I think Wireshark will still have these annoying treeviews.

[Forivin]

Fiddler seems to be a great program! Though it doesn't capture the HTTP requests of a program I wrote on my own. :( So it's pretty much useless for me...

[skivecore]

@Forivin I think Fiddler can be set as proxy and you could direct your app traffic to it (port 9999 by default). docs.telerik.com/fiddler/configure-fiddler/tasks/…

[Forivin]

so should I send the request to port 9999 instead of 80? edit: it tried it and it doesn't work.

[ssnobody]

Forvin, no he means you'd have to build your app such that it understands how to use a proxy server and uses your local fiddler install as that proxy server. Since that may be more of a programming exercise than you want to attempt, you could also try setting up a linux server to act as your gateway, basically acting a bridge between you and your current router. You'd then have that linux server use IPtables to redirect to transparently redirect your outbound port 80 traffic to your proxy server. I'm not sure how process information for filtering would be preserved at that point though...

[Forivin]

The trick was to tell my program to use the system proxy or to tell it to send the traffic through this proxy: localhost:8888 Also, ProxyCap is a great tool to force any exe to connect through a proxy of your wishes.