39

I currently use Little Snitch to control network traffic on my Macbook Pro, and see what my apps are connecting to.

Unfortunately, Little Snitch only shows you the hostname that an app is connecting to. Is there a tool which will show you the full URL of the requests that apps are making? Even better if you can view the headers.

bmike
  • 235,889
Alex Coplan
  • 797
  • Have you been able to go as far as to see when there is a post and even see when a json file is received from a url? – daniel Jul 23 '22 at 00:11
  • I want to be able to login with my valid credentials and make requests to a website I have access to using my own code instead of their website. – daniel Jul 23 '22 at 00:16

6 Answers6

32

The most full featured way to peek into web traffic is to install and configure your system to use a web proxy.

The mitmproxy proxy (and mitmdump tool) is mature, reliable and well documented so I would start there unless you have another that meets your specific needs.

Also, widely used, superbly documented and well regarded is Charles Proxy

Image from mitmproxy.org/images/mitmproxy.png

bmike
  • 235,889
  • This is an excellent solution and it saved me a lot of time, thanks! – Raffi Feb 14 '22 at 19:26
  • mitmproxy is good if you're happy to manually set the proxy server (e.g. in your browser settings). But if you want to see every HTTP request coming from your local machine (even not from a browser), Wireshark is the way to go, with a display filter of http. It's installer automatically gets the OS permissions that it needs to listen, whereas mitmproxy doesn't, and it's tricky to get working. – stwr667 Mar 23 '23 at 06:03
16

Sounds like you need a packet sniffer.

Wireshark will log and do full disassembly on all traffic going through your network interface.

enter image description here

In other words, it will not just show you the full URLs of each request, but it will let you look inside all the packets, so you can see the headers and content too (except in SSL connections, as they are encrypted).

It works on just about every platform out there, including Macs.

Fake Name
  • 5,389
  • 1
    How do you see the URLs? There's so much traffic that I can't see the URLs. – daviesgeek Feb 15 '12 at 23:38
  • 1
    @daviesgeek - Add a filter for GET requests. That will let you just see the requests for HTTP requests. Alternatively, you can filter for whatever type of traffic you are looking for, if you're not just looking for HTTP. It should also be able to filter for DNS requests. – Fake Name Feb 15 '12 at 23:41
  • Also, you're going to want to turn off anything else running in the background, if you can. Since wireshark shows you everything, reducing the volume of traffic you're not interested in helps tremendously. – Fake Name Feb 15 '12 at 23:42
  • This answer has a good explainer on filtering so you only see HTTP requests, and remove all the noise of lower-level TCP, IP, UDP packets, etc: https://serverfault.com/questions/96272/how-to-filter-http-traffic-in-wireshark – stwr667 Mar 23 '23 at 06:04
6

I recommend ProxyMan. It's hands down the best client in this space IMO. The free tier is amazing for most non-pro users. They also have a mobile app. https://proxyman.io . I love this app!

SmileBot
  • 662
  • Doesn't look like there's a free tier any more - $69 as of March 2023. – stwr667 Mar 22 '23 at 03:30
  • 1
    @stwr667 It's a bit hidden. If you go here: https://proxyman.io/pricing and see the section "What are the differences between the Free and Premium versions?" you'll see what the difference is for the free and premium tier. It's a brilliant app. – SmileBot Mar 22 '23 at 21:30
  • Oh gee, that is hidden! So to be clear, is the trial time-limited or not? Even the wording on that looks intentionally unclear. It's clear that it's feature-limited. – stwr667 Mar 23 '23 at 05:22
  • @stwr667 the limits are listed in the explanation on the website. there is no trial limit that I'm aware of. it's a very generous free tier. if you're making money using a tool like this it's considered bad form to not contribute to the developer. – SmileBot Mar 23 '23 at 20:11
2

Whilst it won't give you the full URL, if you're a fan of the command line, then iftop also comes in quite handy and shows you both incoming and outgoing hosts, port numbers (names for well known ports) and cumulative totals for each - as well as live updating "graphs" on the command line :-)

enter image description here

enter image description here

binarybob
  • 9,875
1

HandsOff!

is very similar to Little Snitch. I've explained differences in an answer here.

The network monitor shows hostnames, but it will distinguish them if they have different IPs. Via right-click you can get the specific IP address - you don't get to see the full URL request. But the IP address is more specific anyway.

enter image description here

The developers are open to feature requests. You might see such a feature added in the future.

Community
  • 1
gentmatt
  • 49,722
  • In the picture you see several entries for api.tweetdeck.com (in total it's about a dozen). Each IP has it's own entry. – gentmatt Feb 15 '12 at 19:41
0

A newer application which is available now is Proxie.

Compared to Charles Proxy, which is $50, Proxie is only $10. (Charles Proxy does have a demo available, and is an excellent app, but Proxie has worked very well for me.)

You can use Proxie to see both http and https URLs. There is a fairly simple process required to setup the https monitoring (you need to generate and install a certificate), but it only has to be done once, and the instructions are quite straight-forward.

I believe that this is the easiest solution to the OP’s question.

Dave Powers
  • 113
TJ Luoma
  • 20,659
  • Note that Proxie no longer appears to be available for purchase from the App Store. There is a trial download available from the website, but it likely is not being actively developed going forward. – Dave Powers Jul 25 '22 at 02:33