Get started¶
WireTrail answers questions about a network capture. You give it a HAR file, which is what a browser, a proxy or an app inspector exports, and it tells you what happened: which calls repeated, which failed, which were slow, how a sign-in went, and what changed since the last capture. Each answer is one command.
What you need¶
- A capture in HAR format, version 1.2 or 1.3. Capture shows how to get one. If you do not have one, use the demo captures.
- WireTrail on your
PATH. See Download and install.
The path through this section¶
- Download and install takes a minute.
- Your first triage is a guided investigation of a real capture, from the first summary to the one request that matters.
- Follow along with the demo captures gives you the files, and an answer key for what is in them.
- Choose the right command maps the question you have to the command that answers it.
- What's new lists what each release added.
How WireTrail works, in four sentences¶
WireTrail reads the capture once and groups its requests by host and by a normalized path, so
/users/123 and /users/456 count as one endpoint. Every command is a different question asked of
those groups. Output is plain text for people, and --json gives the same result in a stable
document for scripts. Credentials and secret-looking values are masked in most output, with
limits you should know.