Tab Shark

Just like Wireshark, but just for your browser tab.

Tab Shark is a network-capture and traffic-analysis tool that lives inside a single browser tab. It gives you the kind of deep, packet-by-packet visibility that network engineers get from Wireshark, but scoped to exactly one tab's web traffic and presented in a floating, draggable panel pinned right on top of the page you are inspecting. You click the toolbar icon, a compact capture window appears over the page, and from that moment every network exchange the tab makes is recorded, decoded, color-coded, and made searchable in real time. What It's Used For Tab Shark is built for anyone who needs to see precisely what a web page is doing on the wire: web developers debugging an API integration, QA engineers reproducing a failing request, security researchers auditing what data a page sends and where, and technical support staff diagnosing why a page misbehaves for one user and not another. Instead of guessing what a page is transmitting, you watch it happen: the requests it fires, the responses it gets back, the WebSocket messages it streams, the servers it talks to, and the payloads it carries. How It Works, Just Like Wireshark Wireshark attaches to a network interface and captures every packet crossing it, then dissects each one into human-readable fields. Tab Shark applies the same idea at the browser level. Rather than tapping a NIC, it attaches Chrome's own debugging protocol to the active tab and listens to the full lifecycle of every network request the tab issues. Each request, response, redirect, cache hit, failure, and WebSocket frame becomes a "packet" in a live, scrolling list, exactly like Wireshark's packet list. Selecting any entry opens a detailed dissection: general metadata, request and response headers, the request body, the response body, a raw hex view of the bytes, and a timing waterfall showing DNS, connect, TLS, send, wait, and receive phases. Tab Shark also mirrors Wireshark's most powerful analysis conveniences: Conversation coloring. Every distinct remote IP endpoint is assigned a stable color, so the same server is always the same color everywhere in the capture, just like Wireshark's conversation coloring. You can see at a glance which flows belong to which host. Display filters. A Wireshark-style filter bar lets you narrow the capture with plain text or keyed tokens (for example method:POST, status:4xx, type:xhr, domain:example.com, ip:1.2.3.4, is:sensitive, or -png to exclude), combined with AND logic and negation. Follow / isolate a stream. You can mute any conversation color to silence noisy endpoints and isolate the single dialog you care about, the browser-tab equivalent of following one TCP stream. Marking and annotation. Individual packets can be marked so you can find the interesting ones again. Export for later analysis. The whole capture, or just the filtered subset, exports to HAR 1.2 (openable in DevTools and other HAR viewers), full JSON, CSV, or a readable text dump. On top of the Wireshark-style core, Tab Shark adds a security-analyst layer: it flags requests that plausibly carry credentials, tokens, personal data, or payment information (an authorization header, a password field in a body, a JWT, a possible card number, a plaintext-HTTP request, a login or OAuth endpoint) with a red alert outline and a written reason, so sensitive traffic draws your eye immediately. Benefits - See exactly what a tab sends and receives, with no guesswork. - Debug APIs, redirects, caching, and WebSocket flows faster than reading server logs. - Spot data leaks and insecure requests through the built-in sensitive-request alerts. - Stay in context: the panel floats over the page you are inspecting, so you never lose your place. - Filter thousands of requests down to the handful that matter in seconds. - Isolate a single server conversation by muting the rest. - Hand off findings cleanly by exporting HAR, JSON, CSV, or text. - No external tooling, proxy setup, or certificate installation required; it uses the browser's own instrumentation. Features - Floating, draggable, corner-resizable, minimizable capture panel pinned to the page. - Live capture of every HTTP request, response, redirect, cache hit, and failure in the tab. - Full WebSocket capture, including individual sent and received frames with opcodes and payloads. - Per-request detail: overview, request headers, response headers, request body, response body, raw hex view, and a timing waterfall. - Per-IP conversation coloring with a color legend, and one-click muting to isolate a conversation. - Sensitive-request detection with red alerts and written reasons (credentials, tokens, PII, payment data, plaintext HTTP, privileged endpoints). - Hover inspect cards that summarize a request without leaving the list. - IDA-style persistent text highlighting: color any string and it stays colored everywhere it appears. - Wireshark-style display filters with plain text and keyed tokens, AND logic, and negation. - Packet marking, copy-as-cURL, and keyboard navigation. - Live statistics: totals, failures, cached count, sensitive count, and bar charts by resource type, by status, and top domains by bytes. - Export to HAR 1.2, JSON, CSV, or readable text, for the full capture or the filtered subset. - Configurable capture: response-body capture on or off, WebSocket-frame capture on or off, body size caps, packet-buffer size, preserve-log-across-navigation, and auto-scroll. - Capture state survives navigation and service-worker restarts within the same tab. Conclusion Tab Shark turns a browser tab into a transparent one. It brings the investigative depth of a professional packet analyzer to everyday web work, without a proxy, a separate capture appliance, or a steep setup. Whether you are fixing a broken request, verifying that a page handles data responsibly, or simply learning how a site actually communicates, Tab Shark shows you the whole conversation in a form you can filter, follow, annotate, and export. Disclaimer Tab Shark is intended for lawful use only: inspecting your own traffic, applications, and services, or systems you are explicitly authorized to test. Do not use Tab Shark to intercept, capture, or analyze traffic on any site, account, or system you do not own or lack written permission to examine, and do not use it for any illegal purpose. If there is anything suspicious about the tab or site you intend to investigate, do so only inside a sandbox or staging environment, using disposable test credentials and isolated accounts, never your real logins or production data. You are solely responsible for ensuring your use complies with all applicable laws, terms of service, and organizational policies.