3 ms·

They're not comparable tools. I wouldn't use Wireshark to debug HTTP. And Fiddler simply can't intercept other protocols.

gerdesj 3y ago
Fiddler is a MitM proxy with knobs on. I don't deny it is rather handy. I use a lot of tools. Wireshark simply listens. If you give it the private key for a TLS exchange it is able to decrypt the stream. Fiddler makes changes to the stream - it turns a single stream into two streams with the Fiddler in the middle, Wireshark does not - per se - it just listens but because it will be a tap in a stream it will slightly affect that stream, unless you use a switch that can mirror ports - and that's what I do. When it is your web server (int al) then you have access to the private key and then Wireshark's minimal touch is indicated. Otherwise Fiddler or similar (Squid and others for me) is indicated instead.
- nullindividual 3y ago
  (I've used Fiddler for... ever, so I'm familiar with it) The GP likely doesn't have the private key if they're using Outlook. As if they're using Outlook it is most likely with Exchange. And if they're using Exchange, it is most likely EXO. Hence, Fiddler as the appropriate recommendation for this portion of the thread.
  - gerdesj 3y ago
    If you have to resort to a proxy (fiddler) then you are making changes. You do not get to sample unblemished data. Perhaps that is OK for the snag/issue in question but may not be. Port mirroring/SPAN/RSPAN is the only way to be an observer without affecting the traffic you are inspecting. Fiddler literally does a man in the middle attack. If you don't have access to a private key for a TLS exchange and stream, then you cannot do quite a lot of diags. In the end, Fiddler and the like might do the job but to really get close to the wire requires full knowledge and a much lighter touch. That will be a port SPAN/mirror and Wireshark and a private key.
    - nullindividual 3y ago
      Again, irrelevant for the discussion at hand.

gerdesj 3y ago

Fiddler is a MitM proxy with knobs on. I don't deny it is rather handy. I use a lot of tools. Wireshark simply listens. If you give it the private key for a TLS exchange it is able to decrypt the stream. Fiddler makes changes to the stream - it turns a single stream into two streams with the Fiddler in the middle, Wireshark does not - per se - it just listens but because it will be a tap in a stream it will slightly affect that stream, unless you use a switch that can mirror ports - and that's what I do. When it is your web server (int al) then you have access to the private key and then Wireshark's minimal touch is indicated. Otherwise Fiddler or similar (Squid and others for me) is indicated instead.

nullindividual 3y ago
(I've used Fiddler for... ever, so I'm familiar with it) The GP likely doesn't have the private key if they're using Outlook. As if they're using Outlook it is most likely with Exchange. And if they're using Exchange, it is most likely EXO. Hence, Fiddler as the appropriate recommendation for this portion of the thread.
- gerdesj 3y ago
  If you have to resort to a proxy (fiddler) then you are making changes. You do not get to sample unblemished data. Perhaps that is OK for the snag/issue in question but may not be. Port mirroring/SPAN/RSPAN is the only way to be an observer without affecting the traffic you are inspecting. Fiddler literally does a man in the middle attack. If you don't have access to a private key for a TLS exchange and stream, then you cannot do quite a lot of diags. In the end, Fiddler and the like might do the job but to really get close to the wire requires full knowledge and a much lighter touch. That will be a port SPAN/mirror and Wireshark and a private key.
  - nullindividual 3y ago
    Again, irrelevant for the discussion at hand.