WebSocket Inspection

Rockxy captures WebSocket traffic at the frame level, letting you see every message exchanged between client and server after the initial HTTP upgrade handshake.

​

Entry Points

WebSocket inspection activates automatically when Rockxy detects an HTTP upgrade. The WebSocket tab appears in the response inspector alongside standard HTTP tabs (Headers, Body, Set-Cookie, Auth, Timeline). You can switch back to any HTTP tab to inspect the upgrade handshake headers. No manual configuration is needed.

​

How It Works

Rockxy detects WebSocket connections by monitoring HTTP upgrade requests. When a client sends an Upgrade: websocket header and the server responds with 101 Switching Protocols, the NIO pipeline inserts a WebSocketFrameHandler that captures every subsequent frame. The upgrade request itself appears as a normal HTTP transaction in the traffic list. Once upgraded, the connection switches to the WebSocket tab in the inspector, where all frames are displayed in chronological order. For HTTPS WebSocket connections (wss://), Rockxy decrypts frames using the same MITM approach as regular HTTPS traffic — the HTTPS Interception setup is required.

​

Frame Inspector

Select a WebSocket connection in the traffic list. The WebSocket tab auto-selects in the response inspector. Each frame displays: Click any frame to expand its full payload in the detail pane below the frame list. Direction filter — use the segmented filter above the frame list to show All frames, only Sent (client → server), or only Received (server → client). Frame counts update in real time. Discoverability — WebSocket transactions show their frame count in the request list’s query name column (e.g., “42 frames”), making them easy to spot alongside regular HTTP traffic.

​

Message Decoding

Rockxy automatically decodes frame payloads based on the opcode and detected content:

• Text frames — displayed as text. If the payload is valid JSON, it is automatically pretty-printed with syntax highlighting and a collapsible tree view.
• Binary frames — displayed as a hex dump with an ASCII sidebar. The byte count and offset are shown for each row.

​

Connection Lifecycle

A WebSocket connection in Rockxy follows this lifecycle:

1. Upgrade Request — the initial HTTP request with Upgrade: websocket appears in the traffic list as a standard HTTP transaction with status 101.
2. Open — the connection is established. The WebSocket tab becomes active in the inspector.
3. Frames — text, binary, ping, and pong frames are captured and displayed in real time as they flow through the proxy.
4. Close — a close frame (from either side) terminates the connection. The close code and reason are displayed.

The inspector header shows connection statistics: total frame count, frames sent vs. received, total bytes transferred, and connection duration.

​

Supported Opcodes

​

Next Steps