11

Is there a way to convert wireshark .pcap files to a format that fiddler understands?

Every so often we get network traces generated from wireshark in .pcap files. Most of the time the traces contain mostly HTTP traffic which I find much easier to analyze using fiddler.

Aaron Carlson
  • 5,522
  • 4
  • 31
  • 35

3 Answers3

12

Fiddler 2 and Fiddler 4 now include import support for PCAP, PCAPNG, and NetMon files. Click File > Import > Packet Capture.

Note that only HTTP traffic will be imported (HTTPS traffic is encrypted, and FTP traffic wasn't a priority).

EricLaw
  • 56,563
  • 7
  • 151
  • 196
  • Are you open sourcing this? I've been playing with pcap.net in an attempt to write a importer but if you're working on it already I wouldn't mind getting involved in some form – Aaron Carlson Dec 16 '10 at 14:16
  • What's the status of this importer? – Someone Apr 18 '12 at 11:24
  • Does the "Fiddler 4 supports pcap files" answer indicate that the importer is part of Fiddler 4? And does it also support pcap-ng files? (If so, please make sure it doesn't assume all Interface Description Blocks are at the beginning of a file....) –  Jun 26 '14 at 20:06
  • @GuyHarris: Fiddler2 and Fiddler4 both now import PCAP, PCAPNG, and NetMon CAP files. If you have a problem with any file, please click Help > Send Feedback. – EricLaw Jun 26 '14 at 21:04
  • OK, I tested Fiddler2 with a file that has two IDBs, one of which appears late in the capture, followed by packets for the second interface; it looked as if it was handled correctly. That *probably* means Fiddler2 (and Fiddler4, if the code paths are the same and the only differences are .Net 2 vs. .Net 4 differences) will handle pcap-ng files that don't have all the IDBs at the beginning. –  Jun 27 '14 at 20:49
1

You can use ColaSoft Packet Player which enables to play captured .pcap files and open fiddler on capturing all processes and receive all data as it was captured.

Robob
  • 329
  • 2
  • 6
  • 19
0

Fiddler 4 supports pcap files.

silent tone
  • 539
  • 7
  • 12
  • Don't you think this looks like a comment! – Paresh Mayani Jun 26 '14 at 17:26
  • 1
    No, it looks like an answer, i.e. a way to view pcap files in Fiddler is to get Fiddler 4 and read them in. (This is presumably the result of @EricLaw's work on the importer mentioned in his answer.) –  Jun 26 '14 at 20:05