Search code examples
httpfiddlerwireshark

Fiddler - response packet modifications not showing up in Wireshark?


I have recently been using Fiddler to modify some response packets by adding some code to 'OnPeekAtResponseHeaders' in CustomRules.js. I have noticed that the modified responses are visible in fiddler - but when I try to capture the same traces in wireshark, the responses that I see are unmodified. I assume that this is because wireshark is somehow viewing the responses before fiddler can modify them.

Is there any way for me to view the modified response packets in Wireshark? It's important for me to be able to see them in wireshark so that I can save them in the pcap format.


Solution

  • In order to view the modified response packets in Wireshark, you will need to actually capture the modified response packets, and that means capturing on another machine using something like a SPAN port, TAP or even a hub to allow you access to those packets from the other machine. Alternatively, you could capture the packets at the host receiving those responses, if you have access to it and sufficient user permissions to capture.

    If you do use another machine for capturing, then you might want to have a look at Wireshark's "Ethernet capture setup" wiki page for some guidance (assuming you're capturing on Ethernet of course; otherwise refer to the "See Also" section of the page for other capture setups.)

    Regarding capturing on the same machine as the modified responses, you might want to read Jasper Bongertz's well-written "The drawbacks of local packet captures" blog from a couple of years ago.