Investigations

HTTP Traffic Capture

HTML August 2025

A Docker-based HTTP traffic interception system with dual-proxy architecture and real-time WebSocket monitoring.

This captures both incoming and outgoing HTTP/HTTPS traffic using mitmproxy in Docker. The dual-proxy architecture runs a reverse proxy on port 8080 for incoming requests and a forward proxy on port 8082 for outgoing calls.

The clever bit is the Docker shared network namespace (network_mode: "service:mitmproxy") which lets the proxy capture all traffic transparently. Trace ID correlation groups internal API calls under their parent client requests, so you can see the full call chain.

A custom unified.py mitmproxy addon with a built-in web server provides the real-time monitoring UI. WebSocket updates push new requests as they happen, with scroll pinning and smooth animations. TLS interception handles HTTPS inspection.

It's an experimental project for learning, but the architecture is genuinely useful for debugging microservice communication and understanding API call patterns.

What this project demonstrates

Dual-proxy: reverse (incoming) + forward (outgoing)
Docker shared network namespace for transparent capture
Trace ID correlation for request chain grouping
Real-time WebSocket monitoring with scroll pinning
TLS interception for HTTPS inspection
Custom mitmproxy addon with built-in web server

Technologies

mitmproxyDockerNetworkingGoWebSocket

© 2026 Jonathan Leahy · v1.0.11