The traffic list

Every exchange WireLens captures becomes a row. This page is about finding the one you need.

On the Mac#

The window has three parts:

• Sidebar. The capture status and Start Capture / Stop Capture at the top, then Traffic, Sessions, Compose, Tools and Settings. Below them, a Filter apps and domains field, All Traffic, Saved Folders, Apps, Remote Devices and Domains, each with a count. Click an entry to narrow the list to it.
• Traffic list. A table with the columns Method, Status, Host, Path, Operation, Source, Tools, Size, Time and Duration. Sort by any column, and resize or reorder them. Tools names the rules that changed a flow.
• Inspector. The selected flow's request and response. See The inspector.

Above the table sit the search field, the filter chips, the Saved filters button (a bookmark) and the Custom header columns button (a table icon). File ▸ New Tab (⌘T) opens another tab of the traffic list; ⌘1 to ⌘8 switch tabs.

Filter chips#

One click narrows the list to a kind of traffic. Several lit chips combine.

Filters opens a panel with every filter, grouped:

• Request: Method, Scheme, Protocol (HTTP/1.1, HTTP/2, HTTP/3), API (WebSocket, gRPC, GraphQL, LLM, MCP), Started (Last 5 min, Last 15 min, Last hour).
• Response: Status (status classes and No Response), Content type, Size (> 100 KB to > 10 MB), Duration (> 500 ms, > 1 s, > 3 s).
• WireLens: Capture (Decrypted, Bypassed, Truncated) and Rules (Blocked, Mapped, Rewritten, Breakpoint).
• Annotations: Has comment, Struck, and the eight annotation colours.

Chips in one section match any of them. Sections narrow each other. Clear All turns everything off.

Saved filters and custom columns#

The Saved filters button keeps the current search and chips under a name. Right-click a saved filter for Apply, Update from Current, Rename…, Duplicate, Move Up, Move Down and Delete.

The Custom header columns button turns a Header, a Query parameter or a JSON path from the request or the response into a column. Custom columns sort, and they stay after a restart. A flow without the value shows a dash.

Search syntax#

The search field searches host, path and status as you type. Add a field to be precise. Terms combine with AND.

Some fields have shorter or alternative names: domain for host, code for status, op for operation, mime for type, any for all. A word WireLens does not know as a field is searched as plain text.

A few that earn their place:

host:api.example.com status:>=500
method:=post respsize:>1mb
json:$.errors[0].code -host:*.example.net
operation:CheckoutMutation duration:>1s

The ? next to the search field lists every field; click one to type it for you. Edit ▸ Find in Traffic (⌘F) jumps to the search field.

Keep what matters#

• Annotate. Flow ▸ Annotate… (⌥⌘K) gives a flow a colour, a comment or a strike-through. comment: finds comments again.
• Saved Folders. Right-click flows and choose Add to Folder ▸ New Folder…. A folder keeps its own copy of the flows, which stays after you clear the capture.
• Diff (Pro). Select two flows and press ⇧⌘D (Flow ▸ Diff Selected Flows) to compare them side by side.
• Delete. ⌘⌫ deletes the selected flows, and ⌘Z brings them back.
• Clear. Capture ▸ Clear Captured Traffic… (⇧⌘K) deletes every captured flow and every finished session. It asks first and cannot be undone.

On iPhone and iPad#

The Traffic tab switches between Domains, which groups requests by host, and Requests, the flat list. The toolbar has the magnifier (search and filters) and the trash can (Clear Traffic). The capture bar at the bottom starts and stops capture; tap it for an Overview with status codes, top hosts and the slowest requests.

Search matches host, path, method and status. The filter row under it has these chips:

After them come Method, Status and Scopes. Scopes opens an editor with Host & Path, Header, Body, Content-Type, Flags, Duration (ms) and Size (bytes). Flags includes gRPC, Rewritten, Truncated, Pinned likely and Payload error (200 that failed).

Rows carry chips for what happened to them: Pinned, QUIC, Encrypted, the transport, and the tool that changed the flow.

The ⋯ menu holds Overview, Historical Sessions, Refresh, Export Session HAR, Share Session to Mac, and Share to Team Workspace when your key carries Team Workspace.

On Android#

The Traffic tab shows Capturing · N flows · N hosts under its title. Switch between Domains and Requests; with Group by App on in the ⋮ menu, Domains becomes Apps. The floating button starts and stops capture.

• Search matches URL, method, status and app.
• Filters: Errors, Decrypted, Method, Status and App.
• ⋮ menu: Group by App, Overview (flows, hosts, decrypted, errors, transferred, median time, status mix, top hosts, slowest), Sessions, Export HAR, and Share to Team Workspace with a Team Cloud key.
• Clear traffic empties the list and offers Undo.

Rows carry chips such as Decrypted, Encrypted, Blocked, Map Local, Map Remote, Breakpoint, Script and Rewrite. Long-press a host or a request for the copy actions and rule shortcuts; the host menu also has Delete All from Host, the request menu Delete.

What the status column tells you#

• A number is the status the server sent.
• Not included marks a tunnel to a host you have not chosen to decrypt. Add the host to see inside. See SSL Proxying.
• Decrypt off means the SSL Proxying switch is off. The Mac and Android show a banner with Turn On.
• Excluded is a host on the Exclude list. Pinned is an app that refused the WireLens certificate.
• Failures are named for what happened: DNS failed, Refused, Timed out, Unreachable, Reset, Client aborted, No response, Blocked, Aborted (at a breakpoint), Script aborted. WireLens shows a status code only when a response really came back.

Which app sent it#

• Mac: the Source column names the app that opened the connection, and the sidebar lists traffic under Apps. Phones, simulators and emulators appear under Remote Devices. Traffic WireLens cannot tie to an app shows as Unattributed.
• Android: every request shows its app. Group by App and the App filter narrow the list to one.
• iPhone and iPad: iOS does not tell a VPN app which app sent a request. Rows are grouped by domain instead.