DevTools: Inspect network requests coming from Vivaldi/Chromium itself?

Pathduck

When troubleshooting internal Vivaldi stuff, like recently an issue with downloading the dictionaries, I'm struggling to figure out what network traffic Vivaldi generates in the background. I can of course use Wireshark or similar, but it can't inspect encrypted data unless I jump through hoops setting up a specific test.

So I was wondering if there's a way to use the inspector to look at the network traffic generated by Vivaldi?
I tried to choose inspect on Vivaldi itself from vivaldi://inspect/#apps but no outgoing network requests show up there.

Any way to view this kind of traffic?

LonM

@Pathduck Due to how vivaldi is built, there are 3 potential places it could make requests from:

The main page (which you can get at vivaldi://inspect)
The background page (if you have the debug flags set, it's in the right click menu on the browser)
The chrome engine / exe (for this you need to use a system level monitor like wireshark)

Pathduck

@LonM Thanks for the info - I guess this kind of traffic is generated by the Network Service process, which I assume is Chromium itself. So I'll need to look into how to setup TLS decoding in Wireshark, can't be that hard...

LonM

@Pathduck I recall there being a (insecure) way to have chrome dump the data it uses to generate keys for HTTPS, which can then be used by wireshark to decode the encrypted data.

See: https://peter.sh/experiments/chromium-command-line-switches/ "--ssl-key-log-file"

Pathduck

@LonM Thanks, I figured out how to do it in Wireshark with a little help from a user-friendly guide:
https://www.comparitech.com/net-admin/decrypt-ssl-with-wireshark/

Wasn't even that difficult to do

The guide says to set an envvar SSLKEYLOGFILE, but I'll try with using --ssl-key-log-file which is probably more useful when running several different instances of Vivaldi at once.

LonM

@Pathduck Personally I would prefer a launch flag over an env variable, as an env variable you might forget to un-set it later, which would leave you accidentally logging all your secrets to a file, which isn't very secure.

But functionally I think they both do the same thing.

Pathduck

@LonM Yeah, good point. I also found out that Avast has already been doing the exact same thing, it sets the variable:

SSLKEYLOGFILE \\.\aswMonFltProxy\FFFFC606ADA6AB20

I think that is some kind of local socket connection?

So I might have to disable the Avast web shield to avoid it interfering. But I can deal with that, and I can also live with the web shield, after all it's there for a reason.

Pathduck

This post is deleted!