Which Windows Tool Does A Technician Use To View A Recorded Log Of Network Activity?

Problems in accessing websites tin can oftentimes be establish and fixed if the network traffic between the browser and the website is captured as the problem occurs. This short post explains how to capture such logs.

Capturing Network Traffic Logs

If someone asked you to read this post, chances are good that you were asked to capture a web traffic log to track downwards a bug in a website or your web browser.

Fortunately, in Google Chrome or the new Microsoft Edge (version 76+), capturing traffic is simple:

Optional but helpful: Close all browser tabs but one.
Navigate the tab to near://internet-export
In the UI that appears, printing the First Logging to Disk button.
Choose a filename to relieve the traffic to. Tip: Selection a location y'all can easily find later, like your Desktop.
Reproduce the networking trouble in a new tab . If y'all close or navigate the //net-consign tab, the logging will stop automatically.
After reproducing the problem, press the End Logging button.
Share the Net-Consign-Log.json file with whomever will be looking at it. Optional: If the resulting file is very large, you can compress it to a Nil file.

Privacy-Impacting Options

In some cases, particularly when you dealing with a problem in logging into a website, y'all may need to set up either the Include cookies and credentials or Include raw bytes options before you click the Commencement Logging push button.

Note that there are important

security & privacy implications to selecting these options– if you exercise so, your capture file volition virtually certainly contain private information that would allow a bad histrion to steal your accounts or perform other malicious actions. Share the capture merely with a person you trust and practise not post information technology on the Internet in a public forum.

Tutorial Video

If you're more of a visual learner, here's a curt video demonstrating the traffic capture process.

Alternatives

If you use Border's "Recreate my problem" button on the Feedback Wizard, the feedback tool will capture and include a network trace (in "include cookies and credentials" way) every bit a part of your feedback report.

This method is the easiest way to get a network trace to Microsoft: the JSON is transmitted and stored deeply without yous having to find a way to encrypt and transfer the data. However, this method is inflexible: it does not let y'all to send your traffic log to a friend or adhere it to a bug in the Chromium problems database, and it does not expose the choice to "include raw bytes."

Analyzing Traffic Logs

In a followup mail, I explore how developers can clarify captured traffic.

Thanks for your help in capturing network logs to diagnose and ready problems!

-Eric

Appendix A: Capture on Startup

In rare cases, y'all may need to capture network data early (due east.g. to capture proxy script downloads and the like. To exercise that, close Edge, then run:

msedge.exe --log-internet-log=%USERPROFILE%\Desktop\ ReproNetlog.json --net-log-capture-mode=Everything

If you want to capture unsanitized cookies and authentication headers, but not the response bodies, use --cyberspace-log-capture-manner=IncludeSensitive instead. Omit the final parameter entirely if you do not want to include the raw information and desire just the "Strip Private Information" mode of capture.

Appendix A.one: Capturing Electron and WebView2

Note: The command line argument approach also works for Electron JS applications similar Microsoft Teams:

%LOCALAPPDATA%\Microsoft\Teams\current\Teams.exe --log-net-log=C:\temp\TeamsNetLog.json

Notation: This will only capture the network traffic from the Chromium layer of Electron apps (east.g. spider web requests from the nodeJS side will not exist captured) merely it nevertheless may exist very useful.

WebView2-based applications can either pass the --log-net-log command line into the WebView2 to initiate the capture, or they can add a second WebView control to their application (in the aforementioned context) and navigate it to about:internet-export to allow the debugging user to manually trigger logging.

Appendix B: Mobile Browsers

Appendix B.1: Android

The Net-Export feature works smashing on Android, but take intendance to ensure that yous switch tabs to perform your repro after starting your capture– tab switching is less obvious on Android.

On mobile, when the capture completes, the resulting file is offered to be sent via e-mail (because the mobile file organization is not very attainable).

Appendix B.two: iOS

Unfortunately, on iOS, the Network Export feature is somewhat unlikely to contain the data yous need considering the capture contains only the data sent by Chromium's network stack, not the web content traffic (HTML, JS, CSS, images, etc) used inside the WkWebView control (embedded Safari). To capture data from the entire browser on iOS, you'll need to use another arroyo, e.g. Telerik Fiddler.

Appendix C: Limitations

No Postal service Data

One important shortcoming in the electric current NetLog file format is that it does not incorporate whatsoever request body data, fifty-fifty if y'all select the "Include Raw Bytes" option. If you need the request trunk data, you may need to collect a HTTP Archive (HAR) file instead.

Striking F12 to open the Programmer Tools.
Activate the Network tab.
Ensure the recording push at the peak of the tab is cherry
Tick the Preserve log checkbox.
Reproduce the problem
Right-click entries in the the filigree and choose Save all as HAR with content
Share the HAR file only with a person you trust and do non post it on the Cyberspace in a public forum.

Alternatively, you might but capture the traffic using Fiddler.

Can't Capture Requests that Don't Reach the Network Stack

Perchance surprisingly, the browser's ServiceWorker feature lives above the network stack, so if the browser bug requests that are satisfied locally by the ServiceWorker, that "traffic" is not seen in the NetLog. (fetch requests that are sent from the ServiceWorker to the Network will announced in the log, however.) To meet requests that are satisfied by the ServiceWorker, use the F12 Programmer Tools.

Like to the ServiceWorker case, the Blink engine has a memory enshroud for content that tin can be reused inside a folio. Certain requests (e.thou. if at that place are ten image tags all pointed at the aforementioned URL) may be satisfied past this enshroud without sending the request down to the network stack.

Can't Capture IE Mode

Pages running in Border's IE Mode tabs are loaded using URLMon and WinINET, the Windows Network Stacks used past Net Explorer. Because this traffic does not go through the Chromium Network Stack, it is not recorded in NetLogs.

To piece of work around this trouble, you're probably best off merely capturing the traffic using Fiddler.

Appendix D: References

My tips for Analyzing Captured Traffic
NetLog Viewer WebApp
Fiddler NetLog Importer
Chromium's Traffic Capture instructions
Firefox supports a low-level trace and exporting HAR from DevTools