The traffic list
Find the request you care about in thousands: filter chips, the search syntax, columns, apps and domains.
Every exchange WireLens captures becomes a row in the traffic list. This page is about finding the one you need, fast.
On the Mac#
The main window has three parts:
- Sidebar. Traffic, Sessions, Compose, Tools and Settings at the top. Below them, All Traffic, your Saved Folders, and every app and domain WireLens has seen, each with a count. Click an app or a domain to scope the list to it.
- Traffic list. A real table: sort by any column, resize and reorder columns, and hide the ones you do not use.
- Inspector. The selected flow's request and response. Put it below the list or beside it from View ▸ Inspector Layout, or detach it into its own window with ⌥⇧⌘5.
On iPhone and iPad#
The Traffic tab switches between Domains, which groups requests by host, and Requests, the flat list. Filter chips sit under the search field, and the capture bar at the bottom shows what is recording and how much.
Filter chips#
One click narrows the list to a kind of traffic:
| Chip | Shows |
|---|---|
| Errors | 4xx and 5xx responses, and failures that never got a response |
| Decrypted | Flows WireLens decrypted, hiding bare tunnels |
| WebSocket | Upgraded connections and their frames |
| gRPC | Calls, with their grpc-status |
| GraphQL | Operations, including those with an errors array under a 200 |
| Blocked | Requests your Block List refused |
| Slow | The slowest exchanges |
| Large | The largest payloads |
Search syntax#
Type plain text to search the list the usual way. Add a field to be precise. Terms combine with AND.
| Field | Matches | Example |
|---|---|---|
host | Hostname | host:api.example.com |
path | Path, without the query | path:^/v1 |
status | Response status | status:>=400 |
duration | Milliseconds | duration:>500ms |
url | Scheme, host, port and path | url:^https://api. |
query | Query string only | query:page=2 |
method | HTTP method | method:=post |
reqsize | Request bytes | reqsize:>500kb |
respsize | Response bytes | respsize:>1mb |
type | Content-Type, either side | type:json |
header | A header, either side | header:Content-Type: json |
reqheader | A request header | reqheader:Authorization |
respheader | A response header | respheader:Set-Cookie |
body | Request or response payload | body:"slow down" |
json | JSONPath over a JSON payload | json:$.data[?(@.code>=400)] |
jq | A jq program over a JSON payload | jq:.errors[0].code |
all | Everything, headers and bodies too | all:session-id |
ip | Destination address | ip:104.18 |
app | Source application | app:Safari |
comment | Your comment on the flow | comment:flaky |
operation | GraphQL or gRPC operation | operation:GetUser |
protocol | Negotiated HTTP version | protocol:HTTP/2 |
scheme | http or https | scheme:=http |
And the operators:
| Operator | Meaning |
|---|---|
: | contains |
:= | equals |
:^ | starts with |
:$ | ends with |
* ? | wildcards |
:~ | regular expression |
:> :< :>= :<= | compare numbers |
:100-599 | a numeric range |
!field: or -field: | does not match |
"…" | keep spaces in a value |
A few that earn their place:
host:api.example.com status:>=500
method:=post respsize:>1mb
json:$.errors[0].code -host:*.apple.com
operation:CheckoutMutation duration:>1000ms
On the Mac, the ? next to the search field lists every field, and clicking one types it for you.
What the status column tells you#
- A number is the status the server actually sent.
- MITM off marks a tunnel WireLens was not asked to decrypt. Add the host to SSL Proxying to see inside.
- Failures are named for what happened: refused, timed out, truncated, blocked, aborted at a breakpoint. WireLens never shows a response that did not go over the wire.
Which app sent it#
On the Mac, WireLens attributes each flow to the process that opened the connection, by matching the local socket to its owner. No system extension is involved. Traffic from other devices, and anything WireLens cannot tie to a process, shows as Unattributed.
The iPhone app captures the whole device through its local VPN, which does not reveal the sending app, so rows there are grouped by domain instead.
Keep what matters#
- Comments. Annotate a flow; the
comment:field finds it again. - Saved Folders. Collect flows into folders in the sidebar so they survive clearing the list.
- Diff. Select two flows and press ⇧⌘D to compare them side by side.
- Delete and clear. ⌘⌫ deletes the selected flows, ⇧⌘K clears the capture.
Something here is unclear, or wrong for your setup? Contact support or write to support@wirelens.app.