The traffic list
Every captured request is a row, newest at the bottom. The list is yours to shape: choose columns, filter with one click, color rows, split the view, or group by host, app or device.
Columns
Right-click any column header to show or hide columns, add a custom one, or reset. The built-in columns:
| Column | Shows |
|---|---|
| # | Capture order. |
| Started | When the request began. |
| Method | GET, POST, and so on, colored. |
| Status | Response code, colored by class. |
| Host | The server host. |
| Path | Path and query. |
| App | The local app or process that made the request. |
| Type | Short content kind (json, html, img…). |
| Content type | Full MIME type. |
| HTTP | Protocol version (HTTP/1.1, 2, 3). |
| Server IP | Resolved server address. |
| TLS | TLS version. |
| Req size / Size | Request and response body sizes. |
| TTFB / Time | Time to first byte, and total duration. |
| Comment | Your note on the row. |
Custom columns pull a value from each request: a JSON path like $.data.id, or a header name. Columns reorder by dragging, and the list auto-fits narrow windows by dropping App then Type.
Filter chips
Above the list, one-click chips narrow what you see. They compile to the filter language, so you can combine them with a typed filter.
| Content type | Shows |
|---|---|
| All | Everything. |
| JSON | ct:json |
| HTML | ct:html |
| JS/CSS | ct:javascript OR ct:css |
| Images | ct:image |
| WS | WebSocket connections (is:ws) |
| SSE | Server-sent event streams (is:sse) |
| Errors | is:error OR status:5xx |
| Sent | Requests you sent from elcapture (is:sent) |
A second row of chips filters by status class: Any, 2xx, 3xx, 4xx, 5xx.
Colors, pins and saved filters
Five color dots (red, yellow, green, blue, purple) filter to rows you have highlighted; they combine, and strike excludes. Color a row from its action row or with ⌥1–⌥6 (⌥0 clears). Turn on auto colors to highlight by a rule. Pin a host to keep it one click away, and save a filter with the star in the filter bar; saved filters and pinned hosts appear as their own chips.
Follow, sort, search and split
- Follow selects each new request as it arrives, so the detail panel tracks live traffic.
- Sort by clicking a column header; numeric columns sort numerically.
- Search the filter bar matches metadata; full-body search across request and response bodies is ⇧⌘F.
- Split view opens a second list with its own filter, to watch two slices at once.
The explorer
The explorer groups requests into a tree by domain, app or device, sorted by busiest or A–Z, with its own search. Select one or several nodes (⌘- or ⇧-click combine with OR) to filter the list to them. It appears on windows wide enough to hold it.