Home / server / Questions / 247944
Accepted
Bret Fisher
Asked: 2011-03-16 20:45:46 +0800 CST

How can I see http/https URL's in Microsoft Network Monitor 3.x capture files?

  • 772

I've used Microsoft Network Monitor 3.x before for various reasons but realized today I don't know how to tell the URL inside a conversation. I've got it set for "Windows" Parser Profile and I see a list of TCP and TLS packets, but was hoping there was an easy trick to decipher the HTTP URL requested in the packet details. Fiddler isn't showing me anything for this app accessing the web so I've resorted to netmon which shows me conversations but not sure how to dig out URL's, if possible.

windows network-monitoring packet-capture

2 Answers

  1. Best Answer

    There is an open source NetMon "expert" that can decrypt SSL. As long as you're using one of the cipher suites it supports and, obviously, you have the appropriate private key you should be able to decrypt the traffic.

    • 1

  2. "Microsoft Network Monitor" does not decode https traffic.

    You may use an internet monitoring program(for example: WFilter, websense) instead.

    • 1