Skip to main content

Open a communication

Spider opens every captured communication in the same detail panel - the Global, Headers, Body and Packets tabs are shared across protocols. This page walks through it with HTTP as the worked example; the "Other protocols" note at the end lists what changes for gRPC, PostgreSQL, Redis and Kafka.

HTTP parser​

HTTP parser parses IP packets of a TCP session to find HTTP communications inside.

Especially, it:

  1. Associates a request template depending on the configuration
  2. Extracts HTTP metadata and headers
  3. Extracts client identification
  4. Rebuilds and decode payload
  5. Extracts tags depending on the configuration

Http Parser

HTTP detail panel​

When opening an HTTP communication from the Grid or the Sequence diagram, it opens in the details panel.

HTTP global tab​

The HTTP detail global tab shows main information of the HTTP communication.

The top of the tab is representing the HTTP communication as a graphic frieze, then it lists the most important metadata of the communication.

HTTP graphical representation​

HTTP frieze

HTTP fields​

Http Fields

Most fields are self explanatory by using HTTP own labels and semantic.
But Spider adds some computed fields :

  • Origin: Original IP / Host that did the request (from x-forwarded-for)
  • Identification: Id of the client that did the request (decoded from authorization header)
  • Location: Rebuilt link of the HTTP resource
  • Template: Label of the template as computed by parsing rules
  • Tag: Tags values and label computed
  • Correlation ids: Extracted links correlating calls

Quick filters are available for many of the available fields.

HTTP headers tab​

This tab shows request and response HTTP headers

  • List of keys and values
  • A Quick filter is available for each
  • Decoded authorization header
  • Enriched values from plugins (option)
  • Raw text headers are visible by clicking on view source link.

HttpHeaders

HTTP request and response body tabs​

This tab displays the payload content of the communication.
It also allows downloading of the payload.
3 views are available.

  • Raw - Text representation, after reassembly and decompression
  • Browser - As interpreted by the browser (iframe + content type)
    • Best for images, videos, etc.
  • Interpreted - Parsed and displayed by Spider
    • Color syntaxing and pretty print for HTML, CSS, JS, JSON, XML
    • Context compaction for JSONLD

HttpPayloads

HTTP packets tab​

This tab lists and offers access to the IP packets composing the HTTP communication:

  • Direction
  • Time
  • Payload size
  • First bytes of data

👉 You may click on them to open their details view.
Packets may also be accessed from the graphical representation in Global tab.

HttpPackets

Comparing 2 HTTP communications​

👉 From the grid, you may select 2 or more HTTP communications and compare them straight in Spider.
Differences are highlighted in orange, and changes are marked with green (new) and red stroked (removed).

HTTP metadata and headers are compared as a side by side list:

HttpDiff1

HTTP payloads or compared line by line:

HttpDiff2

Other protocols​

The same panel opens for every decoded protocol; only the payload specifics differ:

  • gRPC - binary protobuf, shown as readable JSON via transcoding (Request/Response tabs).
  • PostgreSQL - the SQL query with its bound parameters, plus the returned rows.
  • Redis - the command, its keys and arguments, and the reply.
  • Kafka - the event, with its key and value payload.

Whatever the protocol, the identifiers Spider extracts from the payload let you follow one thing across all of them - see Follow one thing across protocols.

Now that you know how to capture data and open it, let's see how to follow one thing across protocols - the capability that ties your whole stack together.