# Network Capturing Mode

This article describes using the Fiddler Everywhere **network capturing mode**, where "network traffic" refers to all outgoing TCP traffic. The feature requires the installation of a network extension (macOS) or kernel driver (Windows), which requires explicit administrative privileges.

On Windows, the network capturing mode installs a kernel driver through the Windows Filtering Platform (WFP), which then interacts with the Fiddler proxy to capture network traffic at a lower level.

In nature, the network capturing mode is a more powerful way to capture network traffic on a lower level than an HTTPS(S) proxy works (which is how Fiddler works in the **System Capturing** mode or all other available capturing modes).

The benefits of the network capturing mode are as follows:

* Works on a lower level compared to HTTP(S) proxies.
* Captures all outgoing TCP traffic from the active network adapter.
* No limitations related to frameworks, applications, operating systems, and other configuration specifics that you usually must handle when using an HTTP(S) proxy.
* Allows you to control which IP addresses and processes to monitor.

## Prerequisites & Limitations

Review the following requirements and constraints before using the network capturing mode.

### Prerequisites

You must meet the following prerequisites to use the network capturing mode.

* [Installed the latest version of Fiddler Everywhere](https://www.telerik.com/download/fiddler-everywhere).
* [Installed and trusted the Fiddler Certificate Authority](https://www.telerik.com/fiddler/fiddler-everywhere/documentation/installation-and-setup/trust-fiddler-ca).
* **Administrative privileges** to install/uninstall the network extension (macOS) or kernel driver (Windows).
  * **Windows**: Admin privileges are required to install the WFP kernel driver through the User Account Control (UAC) dialog.
  * **macOS**: Admin privileges are required to install and enable the network extension.

### Limitations

The **Network Capture** mode currently has some known limitations as follows:

* The network capturing mode is available only for Windows and macOS. The Linux version of Fiddler Everywhere does not yet support network capturing.
* **The network capturing mode cannot work alongside the system capturing mode**. If the network capturing mode is enabled, Fiddler will automatically disable the system capturing mode to prevent conflicts.
* Specific VPN tools are closing the VPN connection if a third-party network extension is detected. You can try to workaround that by making the VPN connection **before** starting Fiddler Everywhere and then enabling its network capturing mode.
* To use a VPN connection alongside Fiddler, you often need to bypass specific VPN endpoints (for example, `vpn.mycompany.com`). However, the **HTTPS** > **Connections** > **Bypass Fiddler for URLs that start with:** option is incompatible with **Network Capture** mode. When using Network Capture mode, bypass targeted VPN endpoints \[by creating a Fiddler rule that executes the **Do Not Decrypt** action]\(slug://configure-vpn-fiddler#configuration-for-network-

capturing-mode).

* The network capturing mode can capture only outbound traffic. Currently, inbound traffic from remote devices is not captured. For such cases, use our alternative capturing modes like [reserve proxy](https://www.telerik.com/fiddler/fiddler-everywhere/documentation/capture-traffic/reverse-proxy) or specific capturing modes for [Android](https://www.telerik.com/fiddler/fiddler-everywhere/documentation/capture-traffic/capture-from-android), [iOS](https://www.telerik.com/fiddler/fiddler-everywhere/documentation/capture-traffic/capture-from-ios), or [remote PCs](https://www.telerik.com/fiddler/fiddler-everywhere/documentation/capture-traffic/capture-from-remote-pc).

## Using Network Capturing Mode

The network capturing mode is accessible in the Fiddler **Live Traffic** menu options through the **Network Capture** option.

![the "Network Capture" feature](https://www.telerik.com/fiddler/fiddler-everywhere/documentation/assets/90c12cfc23466062f485414811e587dd/websessions-toolbar-network-capture-beta.png)

Once the **Network Capture** is enabled, you can capture all TCP traffic. As noted in the benefits section, the main perk of using the network capturing mode is that you do not need to change the operating system proxy or set the client's proxy. That lets you quickly capture traffic from processes that otherwise have trouble using HTTP(S) proxies.

To use the **Network Capture**, you need to set the IP address explicitly, the TCP/IP ports, and the (optionally) process name. At least one rule that sets the IP address (or range of IP addresses) alongside the related TCP/IP port must be specified for the capturing to work.

### Start Network Capture

To start the network capturing mode, execute the following steps:

1. Click the **Network Capture** button from the **Live Traffic** menu.
2. Click the **Enable** from the **Network Capture Settings** screen.

> tip The capturing will use the pre-configured rules. [Learn how to modify the default capturing rules or add additional rules...](https://www.telerik.com/fiddler/fiddler-everywhere/documentation/capture-traffic/capture-network-traffic#modify-network-capture-rules)

> important If the system capturing mode is currently enabled, Fiddler will automatically disable it when you enable network capturing mode, as these two modes cannot work simultaneously.

The first time you enable network capturing mode, you must install the required system component with administrative privileges. The installation process differs between Windows and macOS.

**Initial Setup on Windows**

When you enable network capturing for the first time on Windows, Fiddler installs a kernel driver through the Windows Filtering Platform (WFP). This process requires administrative privileges.

1. Immediately after pressing **Enable**, Windows will display a User Account Control (UAC) dialog asking for permission to install the driver.
2. Click **Yes** to allow the installation of the kernel driver.
3. Upon successful installation, the **Network Capture** screen reloads with network capturing enabled.

> important If you click **No** or do not have administrative privileges, Fiddler will display a red toast notification indicating that network capturing cannot be started. The driver installation is required to use this feature.

**Initial Setup on macOS**

When you enable network capturing for the first time on macOS, Fiddler installs a network extension. This process requires administrative privileges.

1. Immediately after pressing **Enable**, you will see a native macOS popup.
2. In the macOS popup, choose **Open System Settings**. In the opened macOS system settings, scroll down to the message that the Fiddler extension is blocked.
3. Allow the Fiddler Everywhere extension.
4. Enter your administrator credentials to install the extension.
5. Click **Allow** to confirm the Fiddler Everywhere network extension installation.
6. Upon successful installation, the **Network Capture** screen reloads with network capturing enabled.

> important Administrative privileges are required to install the network extension on macOS. If you do not have the necessary privileges, Fiddler will not be able to enable network capturing.

### Stop Network Capture

To stop the network capturing mode, execute the following steps:

1. Click the **Network Capture** button from the **Live Traffic** menu.
2. Click the **Disable** from the **Network Capture Settings** screen.

## Modify Network Capture Rules

By default, network capturing mode uses active rules to capture traffic from all IP addresses and processes working on ports 80 (HTTP) and 443 (HTTPS). An additional rule enables capturing from localhost (`127.0.0.1`) on port 3000—this demonstrates how to add specific rules in the **Network Capture Settings** screen.

The **Network Capture Settings** screen offers a **Basic** view for simple rule setup and an **Advanced** view for more complex configurations.

In the advanced view, you can manually control what traffic to capture using these options:

* **IP Address**: Set a specific IP address or the starting address of an IP range (use [CIDR notation](https://www.telerik.com/fiddler/fiddler-everywhere/documentation/capture-traffic/capture-network-traffic#cidr-notation-for-setting-network-addresses) for subnets).
* **Subnet Mask**: Define the subnet mask, which determines the range of IP addresses. Accepts [CIDR notation](https://www.telerik.com/fiddler/fiddler-everywhere/documentation/capture-traffic/capture-network-traffic#cidr-notation-for-setting-network-addresses).
* **Port**: Set the TCP/IP port. Most applications use port 80 (HTTP) and 443 (HTTPS) by default, but custom ports are common for staging, testing, or local development.
* **Filter by PID or process name**: Specify one or more process IDs (PIDs) or process names, separated by spaces. For multi-word process names, use quotes (for example, "Google Chrome Helper"). On macOS, use the Activity Monitor to find PIDs or process names.

### Reset Capturing Rules

To revert capturing rules to their defaults:

* Open the **Network Capture Settings** window.
* Switch to **Advanced** view.
* Click **Reset to Default**.

> tip If network capture properties are set via managed app policies, the reset option will revert to the rules defined by your administrator.

### CIDR Notation for Setting Network Addresses

The **Subnet Mask** field accepts [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) values. For IPv4, the valid range is `0` to `32`; for IPv6, it is `0` to `128`. For example:

| CIDR Value | Subnet Mask       | Effect                                                                                    |
| ---------- | ----------------- | ----------------------------------------------------------------------------------------- |
| `32`       | `255.255.255.255` | Only the exact host address is monitored.                                                 |
| `24`       | `255.255.255.0`   | All addresses in a /24 subnet (for example, `192.168.1.0`–`192.168.1.255`) are monitored. |
| `0`        | `0.0.0.0`         | All IPv4 addresses are monitored.                                                         |

Default rules for ports 80 and 443 use **IP Address** `0.0.0.0` and **Subnet Mask** `0`, covering all IPv4 addresses. IPv6 is also supported (for example, **IP Address** `::` and **Subnet Mask** `0` to cover all IPv6 addresses).

A localhost rule is also included by default:

* IPv4: **IP Address** `127.0.0.0` with **Subnet Mask** `8` (covers the entire `127.0.0.0/8` loopback range)
* IPv6: **IP Address** `::1` with **Subnet Mask** `128` (exact loopback address)

Both localhost rules apply to port `3000`.

## Removing Network Extension

Disabling network capturing does not remove the network extension from your system. To fully remove it, use one of the methods below.

### Removal Through Application Uninstall (Windows)

1. Open the **Windows Control Panel** and navigate to **Programs** > **Uninstall a program**.
2. Select **Fiddler Everywhere** from the list and click **Uninstall**.

> tip The uninstaller automatically stops and removes the `fid_kernel` kernel driver as part of the uninstallation process.

### Removal Through CLI Commands (Windows)

To remove only the kernel driver without uninstalling Fiddler Everywhere, run the following commands in an elevated (Administrator) shell:

```bash
sc stop fid_kernel
sc delete fid_kernel
```

> tip `sc` is the Windows Service Control command-line utility used to communicate with the Service Control Manager. The first command stops the running driver service; the second permanently removes it.

### Removal Through Application Uninstall (macOS)

1. Open the **Applications** folder in Finder.
2. Drag **Fiddler Everywhere** to the **Trash**.
3. In the confirmation prompt, choose **Continue** to confirm removal.

> tip If removal fails, quit Fiddler Everywhere, ensure no Fiddler processes are running (check **Activity Monitor**), and retry the uninstall.

### Manual Removal (macOS)

Use this method to remove only the network extension without uninstalling Fiddler Everywhere:

1. Open **System Settings** on macOS.
2. Go to the **Network** section.
3. Click **Filters**.
4. Select the **Fiddler Everywhere** network extension.
   * Use the toggle or dropdown to disable the extension (it can be re-enabled later without reinstalling).
   * Click the **"-"** (minus) button to permanently uninstall and remove the extension.

## Troubleshooting Network Extension

If you encounter issues with the Fiddler Everywhere network extension, try the following steps:

* Ensure your OS user account has administrative privileges to install and enable network extensions.
* Uninstall any previously installed versions of the network extension (see [removal steps above](https://www.telerik.com/fiddler/fiddler-everywhere/documentation/capture-traffic/capture-network-traffic#removing-the-network-extension)), then reinstall Fiddler Everywhere.
* On Windows, check the **Windows Event Viewer** (under **Windows Logs** > **System**) for errors related to `fid_kernel` to get detailed failure information.
* On macOS, open the **Console** app and filter by `Fiddler` to review system-level extension errors.
* If installation or enablement continues to fail, contact [Telerik Support Center](https://www.telerik.com/account/support-center).

## Best Practices

* Use the Basic view for simple capture needs; switch to Advanced for granular control.
* Always review and reset rules after major updates or policy changes.
* Use descriptive process names or PIDs to avoid capturing unnecessary traffic.
* For troubleshooting, start with default rules and add complexity incrementally.

## See Also

* [Capturing Modes in Fiddler](https://www.telerik.com/fiddler/fiddler-everywhere/documentation/capture-traffic/capturing-modes)
* [Fiddler as a System Proxy](https://www.telerik.com/fiddler/fiddler-everywhere/documentation/capture-traffic/capture-system-traffic)
* [Fiddler as a Reverse Proxy](https://www.telerik.com/fiddler/fiddler-everywhere/documentation/capture-traffic/reverse-proxy)