Download: HTTPREPLAY is a SOCKTRC plugin allowing to analyze and replay HTTP traffic Microsoft Dow

Overview

HTTPREPLAY is a SOCKTRC plugin allowing to analyze and replay HTTP traffic from STRACE or WININET log. You can use this tool to "replay a web server" without needing to setup IIS. The main goal of this tool is to help building a repro scenario when customer can't provide one.

Top of page

System requirements

Supported operating systems: Windows 2000, Windows Server 2003, Windows Vista, Windows XP

Supported Operating Systems (32-Bit x86) : Windows XP, Windows Server 2003, Windows Vista

Top of page

Instructions

To install the tool, click and download the setup file.

The most simple way to get a "replay trace" is to use the STRACE tool. With this tool, no special configuration is needed and you'll not need any special DLL build to get the log. Before getting the log, clear the Internet Explorer cache so that the log can hold all requested objects.

HTTPREPLAY has limited support for WININETLOG. If you plan to replay a non full debug WININET log, the log must have been done using a single connection (this is needed because the session/socket information is not present in non full debug WININET log). To configure Internet Explorer to use a single connection, create the following 2 registry keys :

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings

"MaxConnectionsPer1_0Server"=Dword:00000001

"MaxConnectionsPerServer"=Dword:00000001

Replaying a LOG

To replay a log, use the following command from the HTTPREPLAY directory :

HTTPREPLAY.CMD logfilename

Alternatively, you may use the following command :

SOCKTRC.EXE /S:81 /E:HTTPREPLAY.DLL /LOG:logfilename

Once the parsing of the log is done, a report is displayed in IE with the list of URLs and detailled informion regarding all requests and responses. You'll then be able to access any URL listed after having configured your proxy to LOCALHOST:81.

Optional arguments :

/SETPROXY (set the Internet Explorer static proxy to localhost:port)

When this flag is used, the Internet Explorer static proxy is set to the listening port specified in argument (/D). The proxy server is reset to its original value when HTTPREPLAY is exited.

/RESPECTTIMINGS (respect timings when replaying - this option is only valid if STRACE log is replayed)

When this flag is used, HTTPREPLAY will send the data back to the client using the timings found in the STRACE log.

/STRICTURL (Serve request as exactly specified by the client)

If HTTPREPLAY can't serve a request, it tries to serve it without the hostname. /STRICTURL prevents this behavior.

/IGNOREQS (Ignore the query string)

Client side script or forms with method="GET" may prevent HTTPREPLAY to find the appropriate response for a specific request. When /IGNOREQS, the tool will try to serve a request whatever querystring is used.

/RESPECTPOST (use data POSTed to serve URL)

by default, HTTPREPLAY doesn't use POSTed data to serve a POST request.
If this flag is used, HTTPREPLAY will try to serve request based on URL and POSTed content

/XTRACT (extract each response in a separate file)

see "Replaying from files" section for details

/USEFILES (use response file instead of log)

see "Replaying from files" section for details

/SHOWIMAGES

display thumbnail when content-type of response is image

/QUICKDECRYPT

This flag allows to speedup the decryption of encrypted BLOB but may prevent content
to be fully decrypted (use with caution)
Replaying from files

The /XTRACT switch instructs HTTPREPLAY to extract responses found in the log as individual files. An index file ("index.replay") is also created to associate each response file with the URL requested. To replay the HTTP content from response file, use the /USEFILES switch. If you use both /USEFILES and /LOG, response from index.replay takes precedence over response from the log.

The main benefit of replaying from response files is that the replayed content can be modified. If the content is modified, you'll need to adjust the Content-Length (or Chunk size) header. If you delete the content-length header, HTTPREPLAY will FIN the HTTP connection once the response will be sent. This allows to signal the end of the response. The replay file can reference an external file using the "HTTPREPLAY-FILELINK:" syntax.

Example :

file request0001.replay

---------------------------------------------

HTTP/1.1 200 OK

Content-Type: text/html

Server: Microsoft-IIS/6.0

HTTPREPLAY-FILELINK:common.js

---------------------------------------------

Note that in the example above, the Content-Length header has been volontarily suppressed and you can now modify "common.js" without having any concerns regarding the Content-Length...

You may "clean" the "index.replay" file so that it only keeps references to the file content that you plan to modify (when a requested URL in not found in the index, HTTPREPLAY will serve the URL from the log).

Top of page