WebSocket

WireLens captures WebSocket connections from the upgrade onwards. The upgrade request and the 101 Switching Protocols response appear in the traffic list like any other flow, and the connection stays live there for as long as it is open.

The frame timeline#

Open a WebSocket flow and the inspector adds a Messages view: every frame, sent and received, in order, as it happens.

• Direction, time since the connection opened, and the frame's opcode (text, binary, ping, pong, close).
• Filter the timeline to sent or received frames.
• Expand a frame to read its payload. JSON payloads open in the same tree view as a response body.

The WebSocket filter chip in the traffic list shows every upgraded connection at once.

Decryption#

For wss://, the host must be decrypted like any HTTPS host. See SSL Proxying. Without it, the connection shows as a tunnel with its byte counts.

Scripting the handshake#

A script can define onWebSocketHandshake to act on the upgrade request, for example to add or change a header before the connection is established. See Scripting.

Free and Pro#

The connection overview is free. The live frame timeline is part of Pro, on both Mac and iPhone.

From MCP#

list_websocket_sessions lists captured connections, and get_websocket_messages reads their frames, so an agent can follow a socket conversation the same way you do.