isomoes

Network Traffic Analysis For Claude Code WebSocket Protocol — Development skill for Claude Code

Development community intermediate

This document records methods to capture and analyze network traffic for understanding the Claude Code WebSocket protocol implementation.

How to install Network Traffic Analysis For Claude Code WebSocket Protocol

This entry records only its repository, not the path inside it, so there is no exact command to give. Open isomoes/claude-code-zed and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Network Traffic Analysis For Claude Code WebSocket Protocol does

This document records methods to capture and analyze network traffic for understanding the Claude Code WebSocket protocol implementation.

Alternatives in Development

Quick Plan — Create a detailed implementation plan based on the user's requirements provided through the USER_PROMPT variab 3.4k ★
Problem Analysis Agent — You are an expert problem analysis agent specializing in deep requirements understanding and problem decomposi 129 ★
Claude Code Source Analysis Orange Book — Claude Code: Source Code Analysis · Orange Book Series · Deep dive into Claude Code architecture and implement 109 ★

README

Network Traffic Analysis for Claude Code WebSocket Protocol

This document records methods to capture and analyze network traffic for understanding the Claude Code WebSocket protocol implementation.

Process

First, the VS Code extension will create the [port].lock file in ~/.claude/ide/, where the port number is randomly generated.

{"pid":45272,"workspaceFolders":["/home/isomo/rust/claude-code-zed"],"ideName":"Visual Studio Code","transport":"ws","authToken":"9048d76f-acab-4fbc-87be-1c7ab575d94e"}

Then the Claude Code CLI will check the lock file to try linking to the [port] on TCP. Here we used the tcpdump tool to capture the traffic on port 59791, then started the Claude Code CLI:

sudo tcpdump -i lo -A -tttt port 59791
2025-07-08 13:41:35.156734 IP localhost.42210 > localhost.59791: Flags [S], seq 4189769086, win 65495, options [mss 65495,sackOK,TS val 595966155 ecr 0,nop,wscale 7], length 0
E.. localhost.42210: Flags [S.], seq 3069872564, ack 4189769087, win 65483, options [mss 65495,sackOK,TS val 595966155 ecr 595966155,nop,wscale 7], length 0
E..<..@.@.<..........................0.........
#...#.......
2025-07-08 13:41:35.156752 IP localhost.42210 > localhost.59791: Flags [.], ack 1, win 512, options [nop,nop,TS val 595966155 ecr 595966155], length 0
E..4Z.@.@............................(.....
#...#...
2025-07-08 13:41:35.188319 IP localhost.42210 > localhost.59791: Flags [P.], seq 1:357, ack 1, win 512, options [nop,nop,TS val 595966187 ecr 595966155], length 356
E...Z.@.@..W...............................
#...#...GET / HTTP/1.1
User-Agent: claude-code/1.0.44
X-Claude-Code-Ide-Authorization: 9048d76f-acab-4fbc-87be-1c7ab575d94e
Sec-WebSocket-Version: 13
Sec-WebSocket-Key: dJiOVWbgBNsSP3O+0l1mOw==
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Sec-WebSocket-Protocol: mcp
Host: 127.0.0.1:59791


2025-07-08 13:58:25.784277 IP localhost.59791 > localhost.46700: Flags [.], ack 357, win 509, options [nop,nop,TS val 596976783 ecr 596976783], length 0
E..4..@.@..............l>..^\5[7.....(.....
#.$.#.$.
2025-07-08 13:58:25.784654 IP localhost.59791 > localhost.46700: Flags [P.], seq 1:159, ack 357, win 512, options [nop,nop,TS val 596976783 ecr 596976783], length 158
E.....@.@..:...........l>..^\5[7...........
#.$.#.$.HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: tQ2LNXBALh89K3IVhcqZ6FyInfY=
Sec-WebSocket-Protocol: mcp


2025-07-08 13:58:25.784660 IP localhost.46700 > localhost.59791: Flags [.], ack 159, win 511, options [nop,nop,TS val 596976783 ecr 596976783], length 0
E..4.B@.@.a..........l..\5[7>........(.....
#.$.#.$.
2025-07-08 13:58:25.788982 IP localhost.46700 > localhost.59791: Flags [P.], seq 357:536, ack 159, win 512, options [nop,nop,TS val 596976787 ecr 596976783], length 179
E....C@.@.