This is a migrated thread and some comments may be shown as answers.

Have Fiddler read non standard ports when importing PCAP

3 Answers 346 Views
Fiddler Classic
This is a migrated thread and some comments may be shown as answers.
Bob
Top achievements
Rank 1
Bob asked on 21 Oct 2019, 07:06 PM

I have a capture made with Wireshark of HTTP traffic going through ports 81 and 105. When importing the PCap, Fiddler shows me the transactions going on port 81 but nothing from port 105. I'm able to see them in WS after telling it that port 105 contains HTTP traffic.

Is there something similar for Fiddler?

3 Answers, 1 is accepted

Sort by
0
Eric R | Senior Technical Support Engineer
Telerik team
answered on 24 Oct 2019, 01:20 PM

Hi Bob,

Unfortunately, something like this isn't available in Fiddler. This is because Fiddler only works with HTTP/S and FTP/S or related protocols. If the traffic is not run on this protocol then Fiddler cannot "see" it. Let me provide more details for this scenario below.

When importing a Wireshark PCAP file, Fiddler parses the raw TCP/IP traffic and creates new sessions based on the HTTP/S traffic found within and anything else will be overlooked. Telling Fiddler that all traffic on a specific port is HTTP traffic will still need to be parsed into a new session.

I hope this helps. Please let me know if you need any additional information. Thank you for using the Fiddler Forums.

Regards,


Eric R | Technical Support Engineer
Progress Telerik

Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Feedback Portal and vote to affect the priority of the items
0
Bob
Top achievements
Rank 1
answered on 24 Oct 2019, 06:01 PM

I think I may have skipped some information on the initial message.

My traffic is HTTP traffic. It goest through port 105 because there are multiple sites configured on this server and they are contacted through a reverse proxy based on different ports. But still, it is real HTTP going on port 105.

0
Eric R | Senior Technical Support Engineer
Telerik team
answered on 24 Oct 2019, 06:41 PM

Hi Bob,

In that case, Fiddler should be able to read the sessions. Note that if they are over HTTPS then they will be encrypted and only displayed as a tunnel to. Can you provide the PCAP file so that I can investigate locally?

Please let me know. Thank you and I look forward to your reply.

Regards,


Eric R | Technical Support Engineer
Progress Telerik

Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Feedback Portal and vote to affect the priority of the items
Tags
Fiddler Classic
Asked by
Bob
Top achievements
Rank 1
Answers by
Eric R | Senior Technical Support Engineer
Telerik team
Bob
Top achievements
Rank 1
Share this question
or