Have Fiddler read non standard ports when importing PCAP

4 posts, 0 answers
  1. Bob
    Bob avatar
    2 posts
    Member since:
    Oct 2019

    Posted 21 Oct 2019 Link to this post

    I have a capture made with Wireshark of HTTP traffic going through ports 81 and 105. When importing the PCap, Fiddler shows me the transactions going on port 81 but nothing from port 105. I'm able to see them in WS after telling it that port 105 contains HTTP traffic.

    Is there something similar for Fiddler?

  2. Eric R | Technical Support Engineer
    Admin
    Eric R | Technical Support Engineer avatar
    247 posts

    Posted 24 Oct 2019 Link to this post

    Hi Bob,

    Unfortunately, something like this isn't available in Fiddler. This is because Fiddler only works with HTTP/S and FTP/S or related protocols. If the traffic is not run on this protocol then Fiddler cannot "see" it. Let me provide more details for this scenario below.

    When importing a Wireshark PCAP file, Fiddler parses the raw TCP/IP traffic and creates new sessions based on the HTTP/S traffic found within and anything else will be overlooked. Telling Fiddler that all traffic on a specific port is HTTP traffic will still need to be parsed into a new session.

    I hope this helps. Please let me know if you need any additional information. Thank you for using the Fiddler Forums.

    Regards,


    Eric R | Technical Support Engineer
    Progress Telerik

    Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Feedback Portal and vote to affect the priority of the items
  3. Bob
    Bob avatar
    2 posts
    Member since:
    Oct 2019

    Posted 24 Oct 2019 in reply to Eric R | Technical Support Engineer Link to this post

    I think I may have skipped some information on the initial message.

    My traffic is HTTP traffic. It goest through port 105 because there are multiple sites configured on this server and they are contacted through a reverse proxy based on different ports. But still, it is real HTTP going on port 105.

  4. Eric R | Technical Support Engineer
    Admin
    Eric R | Technical Support Engineer avatar
    247 posts

    Posted 24 Oct 2019 Link to this post

    Hi Bob,

    In that case, Fiddler should be able to read the sessions. Note that if they are over HTTPS then they will be encrypted and only displayed as a tunnel to. Can you provide the PCAP file so that I can investigate locally?

    Please let me know. Thank you and I look forward to your reply.

    Regards,


    Eric R | Technical Support Engineer
    Progress Telerik

    Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Feedback Portal and vote to affect the priority of the items
Back to Top