Capture and inspect WebSocket frames including text, binary, ping/pong, and close messages
Rockxy captures WebSocket traffic at the frame level, letting you see every message exchanged between client and server after the initial HTTP upgrade handshake.
Response inspector > WebSocket tab (auto-selected for WebSocket transactions)
Frame count in traffic list
Visible in the query name column for WebSocket transactions
Protocol filter
Click WebSocket in the toolbar filter bar
WebSocket inspection activates automatically when Rockxy detects an HTTP upgrade. The WebSocket tab appears in the response inspector alongside standard HTTP tabs (Headers, Body, Set-Cookie, Auth, Timeline). You can switch back to any HTTP tab to inspect the upgrade handshake headers. No manual configuration is needed.
Rockxy detects WebSocket connections by monitoring HTTP upgrade requests. When a client sends an Upgrade: websocket header and the server responds with 101 Switching Protocols, the NIO pipeline inserts a WebSocketFrameHandler that captures every subsequent frame.The upgrade request itself appears as a normal HTTP transaction in the traffic list. Once upgraded, the connection switches to the WebSocket tab in the inspector, where all frames are displayed in chronological order.For HTTPS WebSocket connections (wss://), Rockxy decrypts frames using the same MITM approach as regular HTTPS traffic — the HTTPS Interception setup is required.
Select a WebSocket connection in the traffic list. The WebSocket tab auto-selects in the response inspector. Each frame displays:
Column
Description
Direction
Arrow icon indicating sent (client → server) or received (server → client)
Opcode
Frame type: Text, Binary, Ping, Pong, or Close
Payload
Preview of the frame content (truncated for long messages)
Timestamp
When the frame was captured, with millisecond precision
Size
Payload size in bytes
Click any frame to expand its full payload in the detail pane below the frame list.Direction filter — use the segmented filter above the frame list to show All frames, only Sent (client → server), or only Received (server → client). Frame counts update in real time.Discoverability — WebSocket transactions show their frame count in the request list’s query name column (e.g., “42 frames”), making them easy to spot alongside regular HTTP traffic.
Rockxy automatically decodes frame payloads based on the opcode and detected content:
Text frames — displayed as text. If the payload is valid JSON, it is automatically pretty-printed with syntax highlighting and a collapsible tree view.
Binary frames — displayed as a hex dump with an ASCII sidebar. The byte count and offset are shown for each row.
Many real-time APIs (Socket.IO, GraphQL subscriptions, Firebase) send JSON over text frames. Rockxy’s auto-detection formats these payloads for easy reading without any configuration.
