HTTP Traffic

HTTP Traffic captures HTTP, separately from Remote Spy. A game might fire two hundred remotes a second and make four HTTP calls a minute, so mixing them into one stream hides the HTTP calls. Keeping them apart also means you can leave HTTP capture on permanently, since it hooks the request functions directly and costs almost nothing.

What gets captured#

Two buttons in the toolbar, HTTP and RakNet. Both persist per game and are re-applied when a new client connects. They start and stop capture; they do not hide rows already captured.

Captured rows are saved per game in the browser (the last 1,000, bodies cut to 16 KB), the way Remote Spy keeps its calls: reload the page or come back to the game later and they are still there. Clear empties the list for this game.

HTTP covers:

• game:HttpGet and game:HttpPost, with the response
• the executor's request / http_request globals, with the response
• HttpService:RequestAsync, GetAsync and PostAsync

Each record holds the URL, method, headers, body, status, response body, response size and how long it took.

RakNet rows are outgoing raw packets rather than HTTP: one every half second at most, payload truncated to 512 bytes. It needs an executor that exposes a raknet API. Each row names the packet type (Physics, Touches, Marker and so on; the Roblox names come from community reverse-engineering, since Roblox does not document them), its size, how it is sent, and any readable text inside it. Click a row for the full hex dump beside its text.

Replication packets (0x83), which carry property changes and remote calls, are left out of this list: they are nearly all the traffic. To see the remote calls in them, turn on Packets in Remote Spy.

Replaying a request#

Open a row and press Replay. The request goes out again verbatim and the fresh response is shown next to the original. That is how you find out whether an endpoint is still live, whether a token has expired, or what changes between two calls.

Replay uses the executor's own request function, so it carries the same cookies and headers the game would send. Copy as request{} gives you the same call as Lua.

Overriding a response#

The Override / Mock response section of a row, and the mock list in the toolbar, intercept requests by URL and return your own response instead of letting the call go out:

The game receives your response as though the server sent it. This works for the HttpGet family and for the request family. Each rule has a checkbox, so you can leave a mock in the list and switch it off.

Replaying a request whose URL matches an active rule returns the mock, which is also how you test that the rule matches what you think it does.