Skip to content
Docs menu · Inspect traffic

Inspect traffic

New in 1.1

Read WebSocket messages

On this page

A WebSocket appears in the traffic list as its handshake: one row with status 101. Its Messages tab lists the messages that pass in both directions while the connection is open.

Open the Messages tab

  1. Find the WebSocket's row. Its Code column shows 101. Type proto:ws in the search field to list only WebSockets.
  2. Select the row.
  3. On the response side, click Messages.

The tab fills in as messages pass. ws:// needs no setup. wss:// needs the ReqRes certificate installed and trusted. Before that, the connection is one relayed row with no messages. See Trust the ReqRes certificate.

In the free version, opening a wss:// row uses 1 HTTPS inspection, like any HTTPS request. Reading its messages, for as long as the connection stays open, uses no more.

Read a message

A line at the top counts the messages, how many were sent and received with their sizes, and whether the connection is open or closed.

Each message is one line:

PartShows
DirectionAn up arrow and Sent for the app's messages, a down arrow and Received for the server's.
TimeMilliseconds after the handshake, as in "+1,204 ms".
Typetext, binary, ping, pong or close.
SizeThe message's size.
PreviewThe start of the message on one line.

Select a message to see it whole below the list. JSON is indented, text is shown as text, and binary data is a hex dump. The line above it gives the direction and type, the size, the size on the wire for a compressed message, the number of frames when there was more than 1, and the message's number.

ReqRes keeps the first 64 KB of each message. A longer message says so, for example: "ReqRes kept the first 64 KB of this 1.2 MB message; the whole message was forwarded."

The last line of the list says how the connection ended:

  • "Closed cleanly: both sides sent a close frame"
  • "Closed: one side sent a close frame"
  • "The connection dropped without a close frame"
  • "Closed by ReqRes after 10 minutes with no data either way"

It adds which side closed first and the close code and reason, such as 1000 Normal closure, when there are any.

Search messages

  1. Type in the Search messages field at the top of the tab.
  2. Read the count beside the field, such as "3 of 120".
  3. Click ⊗ to clear the search.

The search matches the message text, a close reason, the type and the words Sent and Received, in any case. When the search hides the selected message, its detail is hidden too. The search field in the toolbar does not search messages.

How many messages ReqRes keeps

  • For each connection, ReqRes keeps the first 200 and the last 2,000 messages, in at most 8 MB. A line such as "1,500 messages not kept" marks the gap. A line starting "Not kept:" above the list says why.
  • Across all connections, ReqRes keeps at most 64 MB, 100,000 messages and 1,000 connections. Past a limit, the largest connection loses its oldest messages first. Past 1,000 connections, the oldest connection's messages go.
  • Messages are kept in memory with their row. Deleting or clearing the row removes them, and quitting ReqRes clears them.
  • A saved WebSocket keeps only its handshake, so it has no Messages tab. See Save a session.
  • Every message is forwarded unchanged, whether or not ReqRes keeps it.

If ReqRes cannot read one direction's frames, a line above the list says that it stopped reading them. The connection is not affected.

Limits

  • WebSockets stay on HTTP/1.1, even with Capture HTTP/2 (beta) on.
  • A host on the exclusion list has no row and no messages. See Pass a host through untouched.

What an agent reads

  • list_messages reads one connection's messages, oldest first: direction, type, milliseconds after the handshake, size and the message. Its uid is the 101 row's. It filters by direction (sent or received), opcode and contains, and returns 50 per page, at most 200, with up to 4,096 bytes of each message.
  • wait_for_message waits for the next message that matches, by uid, host, direction, opcode or contains. Messages sent before the call never count. It waits 30 s by default, at most 300 s.
  • Messages are redacted like a body. A binary message is withheld while its host is redacted, and contains matches the redacted text.
  • A HAR file from export_sessions carries the messages in a _webSocketMessages list.

MCP tools lists every tool.