Traffic invisible in Fiddler but visible in Wireshark

[Rémy]

I am trying to do some tests on a dotnet application. However some requests are present in wireshark but not in fiddler?

[Nick Iliev]

Hi Remy,

 

 

Could you provide more details about the request that you are expecting to see in Fiddler? For example, are those HTTP/HTTPS requests (which Fiddler should handle out-of-the-box) or those using some other protocol?

 

Regards,
Nick Iliev
Progress Telerik

[Rémy]

This 2 HTTP request are present in wireshark capture file when i import them into fiddler 4

The second image is a detail image.

 

[Nick Iliev]

Hi Rerny,

Have you configured your NET services to point to the Fiddler proxy as described here?

 

Regards,
Nick Iliev
Progress Telerik

[Rémy]

Yes I did change the machine.config file. I think the app is 'protected' from fiddler.

[Nick Iliev]

Hello Remy,

 

The two sessions shown in the screenshot are non-secure traffic, meaning no HTTPS certificates or advanced security techniques like certificate pinning are used. Are you able to capture the exact requests when the URLs are opened manually outside the NET application? The issue still sounds like a misconfiguration issue rather than the app having specific security settings.

 

Regards,
Nick Iliev
Progress Telerik

[Rémy]

I manage to access the url from edge but cannot capture the edge request in fiddler, on the other hand it works when I use postman.

[Nick Iliev]

Hey Remy,

 

The latest version of Edge is Chromium-based and, by default, uses the OS proxy settings. That would mean that if Fiddler is successfully set as an OS proxy (on Windows, start Fiddler, enable capturing and check Start > Proxy Settings > Manual Proxy), then it should be able to capture all the traffic that does through MS Edge successfully. I am adding a screenshot that demonstrates that Fiddler from Edge successfully captures the test endpoint.

 

Regards,
Nick Iliev
Progress Telerik

[Rémy]

Ok the edge capture works. But not on the program: https://bit.ly/3lCiCV6

 

Here is the screenshot of Edge in Fiddler.

[Nick Iliev]

Hello Remy,

 

Having confirmed that Fiddler can capture the endpoint via a browser means that the issue is most likely within the configuration and/or the security tooling used within your .NET application. It is hard to pinpoint what might be going on without having the actual NET application so I would suggest to re-check the NET configuration for using the Fiddler proxy (and if needed for using the Fiddler root certificate for HTTPS capturing).

As a side note, the bit.ly link you shared is marked as potentially harmful so I am not able to open it due to our corporate security policy.

 

Regards,
Nick Iliev
Progress Telerik

[sum1saw]

Hi Nick,

Same happens with me when I'm trying fiddler Http request aren't captured whereas on SMSniff or Wireshark its capturing perfectly fine.

PF Snapshot via smsniff

[Rosen Vladimirov]

Hello,

Thank you for the additional information. I do not have experience with SMSniff, but from what I've read, I think both SMSniff and Wireshark work on a different level of capturing the traffic. Fiddler Classic works as a proxy tool, so it is required for the requests' sender to respect the proxy configuration in order to see them in the tool. As far as I get it, both SMSniff and Wireshark work on the network adapter itself, no matter what is the proxy configuration and who respects it. 
In order to determine if your requests respect the Fiddler Classic's proxy, you can try stopping the Fiddler Classic application and manually set your OS proxy settings to point to the Fiddler address: http=127.0.0.1:8888;https=127.0.0.1:8888 (which would not be available at that time). In this case, you will not have internet access. So you can check if your application works at this time. If it does, it means the traffic does not go through the proxy and you need to adjust the configuration and the sending of requests in your code.

Hope this helps!

Regards,
Rosen Vladimirov
Progress Telerik

[sum1saw]

Hi Rosen,

Thanks for the reply, as you suggested I researched and found that the application doesn't support proxy setting in its request. Also if I point windows proxy towards localhost application wouldn't run as it send a heartbeat check for internet connection and if connection not found nothing can be done further.

Do you have any other suggestion.

[Rosen Vladimirov]

Hey,

In this case I would suggest to contact the authors of the application and ask them how to configure it in a way to respect the system proxy. 

Hope this helps.

Regards,
Rosen 

[Anna]

So how can I set the default to always auto-advanced, can i do it with an impostor simulator, if not is there any way to fix this

[Nick Iliev]

Hey Anna,

 

Could you elaborate more about what you mean by "set the default to auto-advanced" and an "impostor simulator" in the context of the discussed Fiddler issue? If you are experiencing another issue with Fiddler Classic, you could start a new thread with a detailed explanation of the problem you are facing.