[Networking] How to analyze a trace taken with Chrome Network Log Export

OK, so you have captured a trace using chrome://net-export or if you’re using Microsoft Edge  edge://net-export.

Now you find yourself with a JSON file that you need to analyze.

So, here’s a way to do it:

• Install Fiddler: https://www.telerik.com/download/fiddler
• Download and install the NetLog importer plugin for Fiddler from [ here ]
• Open Fiddler in viewer mode using: Fiddler -viewer
• From the File menu, choose Import sessions then select the import format “Netlog JSON”

• select the JSON file and click “Open”

Now you’ll be able to analyze the trace directly in Fiddler.

In addition to the requests and responses parsed from the log, there are a number of pseudo-Sessions with a fake host of NETLOG that represent metadata extracted from the log:

These pseudo-sessions include:

• RAW_JSON contains the raw constants and event data. You probably will never want to examine this view
• CAPTURE_INFO contains basic data about the date/time of the capture, what browser and OS version were used, and the command line arguments to the browser
• ENABLED_EXTENSIONS contains the list of extensions that are enabled in this browser instance. This entry will be missing if the log was captured using the –log-net-log command line argument
• URL_REQUESTS contains a dictionary mapping every event related to URL_REQUEST back to the URL Requests to which it belongs. This provides a different view of the events that were used in the parsing of the Web Sessions added to the traffic list
• SECURE_SOCKETS contains a list of all of the HTTPS sockets that were established for network requests, including the certificates sent by the server and the parameters requested of any client certificates

Note: the certificates can be viewed by saving the string that begins with “-BEGIN CERTIFICATE” to a file with the .cer extension.

Please keep in mind that the NetLog format does not currently store the request body bytes.

Enjoy!