Wireshark - How do I filter just traffic from visual studio?

Question

I am trying to use wireshark to discover why visual studio is not downloading debug symbols.

1) How do I determine which of the addresses that I see in the wireshark capture is that of visual studio?

2) How do I filter so I just see traffic froma and to Visual Studio in the capture pane?

My related question on trying to discover why visual studio is not downloading debug symbols is here - Debug Symbols not loading

Solution 1

Process Monitor is a nice lightweight tool for seeing which sockets a process is using. You can filter the PID or the .exe name (e.g. devenv.exe)

If you run Wireshark at the same time you can then filter on the right sockets to do your performance analysis.

Solution 2

You can set a capture filter to only display traffic from a specific tcp port, which you can point to the port where your IIS is running. This choice is under the capture->options menu in Wireshark. Once you are only capturing traffic from a single port, it is alot easier to tell who is sending/receiving each packet.

Comments

[Duncan Gravill]

Thanks for the advice. I have tried this but I am not seeing any traffic on port 3389. How do I find out which port IIS is running under? Also do I really need to be filtering for the IIS port. I am only trying to see if there is any traffic from visual studio trying to download symbols (not any application that I am developing) does the traffic of visual studio itself go via IIS?

[javram]

Sorry, I thought the question was more about how to filter tcp traffic using wireshark. Are you trying to do remote debugging from Visual Studio? or are you trying to run on your local machine and can't debug.

[Duncan Gravill]

The question is about capturing traffic with wireshark. I am trying to configure visual studio to download debug symbols so I can step into the .net source code. Visual Studio itself should be downloading the debug symbols but for some reason it isn't working. So I would like to use wireshark to view the traffic between visual studio and the mircosoft symbol servers. I know very little about networking and wireshark but I would expect visual studio would comunitcate directly with the symbol servers. Does it not? How do I filter to see just this traffic? thanks

[javram]

Wireshark is probably overkill for what you are doing, it is much better suited to running traces on the server. You may be able to get a better idea of the network traffic being sent from your local machine using a program like Fiddler, fiddler2.com/fiddler2 which is much more user friendly. Unfortunately, I can't help much with the other part of figuring out why the symbols aren't being downloaded :(

[Duncan Gravill]

Thanks, I have tried fiddler. I don't see any relevant traffic in fiddler. Another person has informed me that fiddler is just a proxy that deals with http and so may not capture the symbol load requests.