views:

153

answers:

2

I totally love the way Fiddler neatly reduces a flood of HTTP information to just the stuff I want to see.

I was wondering whether there is a utility out there that does the same for socket operations and calls? WireShark/Etherial is great, but the flood of data makes it difficult to easily understand what is going on?

Is there something out for akin to Fiddler, but for sockets?

+5  A: 

Yep. Its called Wireshark.

I think that what you need to look into is how to use filters effectively in Wireshark. Reading the information gets a lot easier when you have a good filter (or two) in place.

Stargazer712
+1 Some good filters make it quite manageable. You can filter on address, port, packet type, etc. And if you really need more detail, you can write a custom dissector and create your own filters and packet displays.
Mark Wilkins
+4  A: 

I don't have a better alternative to Wireshark, but here are a couple of things that have helped me harness the beast--er shark.

  • Right-click on a packet and do a 'Follow TCP Stream' to see all the communication on that socket for that particular session.

  • Use the correct filter for the data you are looking for. For HTTP, just type 'http' in the filters box and hit apply. All the TCP/UDP packets are hidden and the parsed HTTP request and responses are the ones that are shown. When you select a HTTP request/response, you can expand it to see the reconstructed request/response.

Again, the filters are your friend in Wireshark. It is very powerful and can save you lots of time when you apply the correct filter.

Kekoa