Friday, October 12, 2012


Download and extract it anywhere. Double-click C:\anywhere\tcpmon-1.0-bin\build\tcpmon.bat, which launches a background console and a Java GUI.

We want to observe the traffic between a browser and a website like, so we will run tcpmon on the same box as the browser, and that box happens to be not using port 8123. We will tell the browser to hit our tcpmon box at port 8123 and tell tcpmon to forward that traffic on to

On the tcpmon admin tab:

Listen Port #: 8123
Act as a...
  Target Hostname:
  Target Port #: 8080

This creates a new tab named Port 8123. Switch to that tab, then hit http://localhost:8123/app/page.jsp in your browser and you should see the and tcpmon should report the traffic

Be careful. It looks like each row at the top of the tcpmon GUI corresponds to a client-server message pair at the bottom of tcpmon GUI, like this:

client sends

POST /app/process.jsp HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:15.0) Gecko/20100101 Firefox/15.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://localhost:8123/app/page.jsp
Content-Type: application/x-www-form-urlencoded
Content-Length: 6521


server replies

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Transfer-Encoding: chunked
Date: Fri, 12 Oct 2012 14:58:56 GMT


But that's not the case. Each row at the top of the tcpmon GUI may in fact contain several client-server message pairs.

{ "loggedin": false, "owner": false, "avatar": "", "render": "nothing", "trackingID": "UA-36983794-1", "description": "How to capture or inspect the raw HTTP traffic between client and server.", "page": { "blogIds": [ 80 ] }, "domain": "", "base": "\/michael", "url": "https:\/\/\/michael\/", "frameworkFiles": "https:\/\/\/michael\/_framework\/_files.4\/", "commonFiles": "https:\/\/\/michael\/_common\/_files.3\/", "mediaFiles": "https:\/\/\/michael\/media\/_files.3\/", "tmdbUrl": "http:\/\/\/", "tmdbPoster": "http:\/\/\/t\/p\/w342" }