Network Traffic Analysis for Claude Code WebSocket Protocol

Network Traffic Analysis for Claude Code WebSocket Protocol

This document records methods to capture and analyze network traffic for understanding the Claude Code WebSocket protocol implementation.

Process

undefined

{"pid":45272,"workspaceFolders":["/home/isomo/rust/claude-code-zed"],"ideName":"Visual Studio Code","transport":"ws","authToken":"9048d76f-acab-4fbc-87be-1c7ab575d94e"}

undefined

sudo tcpdump -i lo -A -tttt port 59791
2025-07-08 13:41:35.156734 IP localhost.42210 > localhost.59791: Flags [S], seq 4189769086, win 65495, options [mss 65495,sackOK,TS val 595966155 ecr 0,nop,wscale 7], length 0
E.. localhost.42210: Flags [S.], seq 3069872564, ack 4189769087, win 65483, options [mss 65495,sackOK,TS val 595966155 ecr 595966155,nop,wscale 7], length 0
E..<..@.@.<..........................0.........
#...#.......
2025-07-08 13:41:35.156752 IP localhost.42210 > localhost.59791: Flags [.], ack 1, win 512, options [nop,nop,TS val 595966155 ecr 595966155], length 0
E..4Z.@.@............................(.....
#...#...
2025-07-08 13:41:35.188319 IP localhost.42210 > localhost.59791: Flags [P.], seq 1:357, ack 1, win 512, options [nop,nop,TS val 595966187 ecr 595966155], length 356
E...Z.@.@..W...............................
#...#...GET / HTTP/1.1
User-Agent: claude-code/1.0.44
X-Claude-Code-Ide-Authorization: 9048d76f-acab-4fbc-87be-1c7ab575d94e
Sec-WebSocket-Version: 13
Sec-WebSocket-Key: dJiOVWbgBNsSP3O+0l1mOw==
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Sec-WebSocket-Protocol: mcp
Host: 127.0.0.1:59791


2025-07-08 13:58:25.784277 IP localhost.59791 > localhost.46700: Flags [.], ack 357, win 509, options [nop,nop,TS val 596976783 ecr 596976783], length 0
E..4..@.@..............l>..^\5[7.....(.....
#.$.#.$.
2025-07-08 13:58:25.784654 IP localhost.59791 > localhost.46700: Flags [P.], seq 1:159, ack 357, win 512, options [nop,nop,TS val 596976783 ecr 596976783], length 158
E.....@.@..:...........l>..^\5[7...........
#.$.#.$.HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: tQ2LNXBALh89K3IVhcqZ6FyInfY=
Sec-WebSocket-Protocol: mcp


2025-07-08 13:58:25.784660 IP localhost.46700 > localhost.59791: Flags [.], ack 159, win 511, options [nop,nop,TS val 596976783 ecr 596976783], length 0
E..4.B@.@.a..........l..\5[7>........(.....
#.$.#.$.
2025-07-08 13:58:25.788982 IP localhost.46700 > localhost.59791: Flags [P.], seq 357:536, ack 159, win 512, options [nop,nop,TS val 596976787 ecr 596976783], length 179
E....C@.@.