RSA Product Set: All RSA Products
Platform:  Desktop/laptop computers running:

• Mozilla Firefox
• Google Chrome
• Microsoft Edge
• Microsoft Internet Explorer

To troubleshoot an issue when using RSA products from a web browser on a desktop or laptop computer , RSA Support may ask you to capture a trace of the HTTP or HTTPS web session to a HAR (HTTP Archive) file.  The HAR file will contain all HTTP/HTTPS requests and responses, including headers, body, status codes and timing.  

When you have finished reproducing an issue, upload the saved HAR file to RSA Support for analysis.

There are two methods RSA has documented for capturing a network trace:

Browser Developer Tools

Use a Developer Tools trace as the easiest way to capture HTTP and HTTPS traffic in the browser tab where the trace is started.

No separate utility installation is required. This is a built-in feature of all major web browsers.  No proxy is used.

However:

• Browser developer tools may not capture the body of all messages.  For example, it may not capture very large messages, response bodies that violate origin rules, streaming messages or service worker messages  .
• Browser developer tools is not suitable if traffic must be captured in more than one tab of a browser.  For example, if a web page opens another tab or window that also needs to be traced.

These restrictions are acceptable for most types of issues that Support may ask you to trace.

Instructions in this article are for the latest released versions of the below browsers on desktop/laptop computers. The required steps may differ in earlier and later versions.

• Mozilla Firefox (Preferred.  It is more likely to capture full HTTP/HTTPS message bodies than the other browsers)
• Google Chrome
• Microsoft Edge
• Microsoft Internet Explorer

Apple Safari captures significantly less useful data in HAR files than Firefox or Chrome—especially request bodies and response bodies.  Use Firefox or Chrome if possible on MacOS.

Fiddler

Use Fiddler when it is necessary to capture HTTP and HTTPS traffic in all tabs of the browser or capture full request/response bodies.

However:

• Fiddler is a third-party utility that must be installed on the user's computer.
• Fiddler inserts itself as a proxy to the session, with its own digital certificate.  In some circumstances having Fiddler as a proxy can change session behaviour or prevent you from accessing the web server. 

Browser developer tools is the preferred option where possible.

Mozilla Firefox (preferred)

Version 149

Firefox is preferred, as it is most likely to capture full HTTP/HTTPS request and response bodies. 

1. Open Firefox and go to the tab where you intend to reproduce the issue you need to capture.
2. From the browser window, open Developer Tools directly to the Network tab:
   • Windows/Linux: Ctrl + Shift + E
   • MacOS: Cmd + Option + E
3. In the Network tab:
   • Click the  (Network Settings) icon then select Persist Logs
   • Select Disable cache  
4. Click the (clear) icon to start fresh.  
   • The message "Perform a request or Refresh the page to see detailed information about network activity" will be displayed in the Developer Tools frame until some activity is captured.
5. Reproduce the issue
   • In the same browser tab, perform all actions you want captured (login, API calls, navigation, etc.)
   • You will see records scrolling in the Developer Tools Network frame.
   • Keep Developer Tools Network frame open the entire time.

3. In the Network tab, export to a HAR file
   1. Click the (Network Settings) icon in the Network tab
   2. Select Save All As HAR

Reference:  https://firefox-source-docs.mozilla.org/devtools-user/network_monitor/

Google Chrome

Version 147

1. Open Chrome and go to the tab where you intend to reproduce the issue you need to capture.
2. Open Developer Tools
   • Windows/Linux: F12 or Ctrl + Shift + I
   • MacOS: Cmd + Option + I
3. Go to the Network tab.  You may have to click (More tabs) icon to see the Network tab.
4. Configure tracing
   
   • Select Preserve log
   • Select Disable cache
   • Allow the trace to include Cookie, Set-Cookie and Authorization HTTP headers:
     1. Open Developer Tools Settings:  click anywhere in the Developer Tools frame and then use F1 or Shift + ? 
     2. Scroll down to the Network section
     3. Select Allow to generate HAR with sensitive data
     4. Click X at top right to close the Settings menu.
5. Click the   (clear) icon to start fresh.
   • The message "Currently recording network activity" will be displayed in the Developer Tools frame until some activity is captured.
6. Reproduce the issue
   • In the same browser tab, perform all actions you want captured (login, API calls, navigation, etc.)
   • You will see records scrolling in the Developer Tools Network frame.
   • Keep Developer Tools Network frame open the entire time.
7. In the Network tab, export to a HAR file
   1. Click the (Export HAR) icon.
   2. Click Export HAR (with sensitive data)

Reference:  https://developer.chrome.com/docs/devtools (scroll down to section "Analyze network activity")

Microsoft Edge

Version 147

1. Open Edge and go to the tab where you intend to reproduce the issue you need to capture.
2. Open Developer Tools
   • Windows:  F12 or Ctrl + Shift + I
   • MacOS: Cmd + Option + I

If prompted, select Open Dev Tools.

3. Go to the Network tab.
   • Click the   (network) icon.
   • If the icon is not visible, click the (More tools) icon then select Network.
4. Configure tracing
   • Select Preserve log
   • Select Disable cache
   • Allow the trace to include Cookie, Set-Cookie and Authorization HTTP headers:
     1. Open Developer Tools Settings:  click anywhere in the Developer Tools frame and then use F1 or Shift + ? 
     2. Scroll down to the Network section
     3. Select Allow to generate HAR with sensitive data
     4. Click X at top right to close Settings.
5. Click the   (clear) icon to start fresh.
   • The message "Currently recording network activity" will be displayed in the Developer Tools frame until some activity is captured.
6. Reproduce the issue
   • In the same browser tab, perform all actions you want captured (login, API calls, navigation, etc.)
   • You will see records scrolling in the Developer Tools Network frame.
   • Keep Developer Tools Network frame open the entire time.
7. In the Network tab, export to a HAR file
   1. Click the (Export HAR) icon.
   2. Click Export HAR (with sensitive data)

Reference: https://learn.microsoft.com/en-us/microsoft-edge/devtools/network/ 

Microsoft Internet Explorer

Version 11

Caution: This browser is no longer supported and may not work with your RSA product.  

1. Open the Internet Explorer browser and go to the tab where you intend to reproduce the issue you need to capture.
2. Press the F12 key on your keyboard.  A Developer Tools window will open within the browser tab.
3. Click on the Network tab in the Developer Tools window.   
   • Make sure the icon for Always refresh from server is selected.
   • Make sure the icon for Clear entries on navigate is NOT selected (it is selected by default). 
   • Make sure the Content Type drop-down box has All selected.
      
     
      
4. Reproduce the issue in the main window of the browser tab you have open.  You will see records and graphs scrolling in the Developer Tools window.
5. When you have reproduced the issue, click the disk icon for Export as HAR (Ctrl-S)  in the Developer Tools window.
    
   
    
6. Follow the Save As prompt to save the HAR file to a suitable location.   Choose a file name that ends in .har.  The file will be saved to the folder location you specify in the Save As dialogue.

• All data displayed and entered while the network capture is active will be saved to the HAR file, including sensitive data such as names and passwords.  Even data that was encrypted over an HTTPS session will be saved in the clear in the HAR file.   Any passwords used during the capture should be changed after the test.  Discuss any security or privacy concerns with your company's IT security team and RSA Customer Support.
• HAR is an acronym for HTTP Archive.
• HAR file data can be viewed in any 3rd party online HTTP Archive viewer or using a compatible 3rd party tool such as Telerik Fiddler.
• Captured traces do not include:  DNS lookup details, TLS handshake internals, non-HTTP traffic and network traffic from before Developer Tools Network tab opened

If you need to capture a web session specifically for an RSA Community issue you are experiencing, please refer to one of the articles listed below.

• How to collect a network trace for RSA Community issues in Google Chrome
• How to create a network trace for RSA Community issues in Mozilla Firefox