Inspecting traffic

The list

Each row is one exchange: Method, Status, Type, Host, Path, Size (of the response body) and Time. New rows appear as traffic arrives, and the list follows them while you're scrolled to the bottom with nothing selected.

• Status shows the response code, … while waiting, or why the request failed (see below).
• Type comes from the response's content type: json, html, js, css, image, font, media, xml, text, websocket or other.
• A Rule badge means a Pro rule handled the request; a HAR badge means it was imported.

The quick filters above the list (All, JSON, HTML, JS, CSS, Images, Media, Fonts, WebSockets, Other, Errors) narrow it by type; Errors shows failed requests and any status of 400 or above. The search box takes words and field filters such as status>=400 or host=api.*: see Search and filters.

The list keeps the most recent 10,000 exchanges. Past that, the oldest leave the list, with their bodies.

Pause and clear

• Pause recording lets traffic through without recording it, until you click Resume recording.
• Clear empties the list at once and offers Undo for 10 seconds, longer while your pointer or keyboard focus is on the notice. After that, the cleared requests and their stored bodies are deleted. Requests that arrive in the meantime stay.

The detail pane

Click a row, or move to it with the arrow keys, to open its details beside the list (or below it, in a narrow window). Drag the divider to resize; Escape closes it.

• Copy URL and Copy as curl (also in the row's right-click menu). The curl command repeats the request with its method, headers and body; a binary body becomes --data-binary @body.bin, a file you save yourself. WebSockets have no curl command.
• Overview: status, protocol, body sizes, and Handled by when a Pro rule answered.
• Timing: time to receive the request, waiting for the server, sending the response, and the total.
• Query: the URL's parameters, one per line.
• Request headers and Response headers, exactly as sent, in order.
• Request body and Response body.

Bodies

Bodies are decoded (gzip, deflate, Brotli, zstd) before they're shown. Each has up to three views:

• Formatted: JSON pretty-printed, and HTML, XML, JavaScript and CSS too when they're up to 2 MB. For images this view is Image.
• Text: as received, decoded.
• Hex: for anything, and the only view for binary data.

Copy copies what's shown. Save… saves the whole body to a file, decoded where possible.

The view shows the first 5 MB of a body. Wirescry keeps up to 512 MB of each body, so Save… gets more than the view does; past 512 MB the traffic still passes through, and the size is still counted.

When requests fail

If the server can't be reached, Status says why, and the detail pane explains it in plain language:

Status	Meaning
DNS	The host name couldn't be looked up.
Refused	Nothing is listening on that port.
TLS	The server's certificate failed a check, for example expired, self-signed, or for another name.
Timeout	Connecting to the server timed out.
Reset	The server closed the connection unexpectedly.
No route	There's no network route to the server.
Closed	The client gave up before the response arrived.
Rule	A Pro rule closed the connection or never answered, on purpose.
Failed	Anything else; the detail pane gives the error code.

When the server never answered, Wirescry replies to the client with a 502, and the detail pane labels that response "sent by Wirescry". If the server started responding and then broke off, the body shows what arrived.

Wirescry sets no response timeout of its own, so long-polling and slow responses keep working.

WebSockets

WebSocket connections appear with status 101 and type websocket. Select one to see its messages live: direction, time since the connection opened, size and content, with JSON formatted and binary data as hex. Filter by ↑ Sent or ↓ Received, or search the messages.

Wirescry keeps up to 64 KB of each message and 64 MB in all, dropping the oldest first, and the view shows the last 2,000 messages of a connection.

If the proxy restarts

Wirescry's proxy runs in a separate process. If it stops unexpectedly, it restarts on its own, and a notice says so. Requests from before stay in the list, dimmed, but only their summaries are left: their headers and bodies were lost. If it keeps stopping, Wirescry stops restarting it and shows Restart proxy and Show log.

Keyboard shortcuts

Use ⌘ on macOS and Ctrl on Windows and Linux.

Shortcut	Does
⌘/Ctrl+F	Find: focus the search box
⌘/Ctrl+P	Pause or resume recording
⌘/Ctrl+K	Clear the list
⌘/Ctrl+O	Import HAR…
⌘/Ctrl+S	Export HAR…
↑ ↓	Move through the list
Escape	Close the detail pane, or clear the search box when it has focus