ContextQMD
Back to Whistle

Network Interface

docs/en/docs/gui/network.md

2.10.96.1 KB
Original Source

Network Interface

Interface for viewing and managing captured packet data

Bottom Search Box {#filter}

The search box supports various advanced filtering methods, allowing you to quickly locate specific types of requests by prefix:

PrefixFilter TargetExample
No PrefixRequest URLexample.com/api /abc=123/i
m:patternRequest Methodm:pos m:/get|post/i
h:patternRequest/Response Header Raw Texth:image/ h:/cookie:\s*test=123/i
H:patternRequest Header Host FieldH:example.com H:/test/i
b:patternRequest/response body original contentb:"error":true b:/\d{3}/
i:patternClient IP or server IPi:11.2 i:/^11\.2/
s:patternResponse status codes:404 s:/5\d{2}/
t:patternResponse header Content-Typet:json t:/html|xml/i
mark:patternRequest URL manually marked in the right-click menumark:example.com mark:/\d{5}/
app:patternFilter by app nameapp:wechat app:chrome
fc:patternRequest URL issued by Composerfc:/test/ fc:www.test.com
e:patternErrored request URLe:timeout e:/abort/i
style:patternstyle Operation contentstyle:italic style:/ita/i

pattern is a keyword or regular expression. Use "AND" to search for multiple conditions:

txt
b:/"success":false/ m:POST s:200 H:api.example.com

Settings

Exclude Filter and Include Filter allow for refined filtering of captured data not displayed in the Network view. Multiple condition combinations are supported:

Filter TypeFunction
Include FilterOnly retain requests that meet the conditions (equivalent to a whitelist)
Exclude FilterExclude requests that meet the conditions (equivalent to a blacklist)
  1. Conditions within a single input box
    • Separation method: Use spaces or newlines to separate multiple conditions
    • Logical relationship: Conditions are ORed

    Example: example.com api.test.com → Matches requests from example.com or api.test.com

  2. Conditions between multiple input boxes
    • Logical relationship: Conditions are ANDed
    • Example:
      • Include Filter input: m:GET
      • Exclude Filter input: h:/cookie:[^\r\n]*test=123/
      • Result: Only GET requests are retained, and requests containing test=123 in the request header cookie are excluded

Supported filter conditions:

SyntaxEffectExample
no prefixMatches requests whose request URL contains this keyword.example.com
m:patternMatches request methodm:POST (matches POST requests)
h:patternMatches original request headerh:/cookie:[^\r\n]*test=123/ (matches cookies)
H:patternMatches request header Host fieldH:example.com H:/test/i
i:patternMatches client IPi:11.2 i:/^11\.2/

Different from the search box at the bottom of the Network list:

FunctionNetwork search boxFilter in Settings
Match rangeAll data in the request and response stagesMatches only the request phase (does not include response data)
Effective TimeFilters displayed and future requests in real timeEffective only for new future requests
Affects Historical DataCan filter existing packet capture recordsDoes not affect displayed requests

Other Options:

Item NameFunction Description
Network ColumnsCustomize the columns displayed in the packet capture list (such as status code, method, size, etc.)
Maximum RowsSet the maximum number of packets displayed simultaneously (to prevent memory overflow)
Viewing only your computer's requestsDisplays only requests sent by the local computer (filters requests from other devices/remote requests)
View All in new windowClick "View All" to open the full content in a new window (suitable for viewing large response bodies)
Show Tree ViewDisplays requests in a tree structure (grouped by domain name/path)

Details Panel {#detail}

  1. Overview: Basic information about matching rules and requests
  2. Inspectors: Detailed information about request/response headers and content
  3. Timeline: Request performance information
  4. Composer: Composer interface
  5. Tools: Various tools
    • Console: Displays remote console logs. For details, see Console
    • Server: Displays exceptions that occur during Whistle execution
    • Toolbox: Common tools and methods

Other Menus

  1. Replay: Replays the selected capture data
  2. Edit: Populates the capture data in the Composer window on the right
  3. Arrow button in the upper right corner: Switches to top-down panel mode, suitable for portrait-oriented monitors

Debugging WebSocket/TCP {#websocket}

After selecting a WebSocket/TCP request, you can use the Inspectors/Frames panel to debug the request/response data:

Supported:

  1. Use the Send/Receive, Pause, and Ignore buttons in the top menu to start, pause, or ignore WebSocket/TCP data transmission.
  2. Use Composer in the bottom details panel to send custom data to the client or server.

If you need to ignore or pause the connection immediately after it's established, you can use the following rules:

txt
www.example.com/path enable://ignoreReceive
www.example.com/path enable://ignoreSend
www.example.com/path enable://pauseReceive
www.example.com/path enable://pauseSend

Other debugging methods:

  1. Using rules: frameScript
  2. Using plugins: Plugin Development