My Setup
- Host: MacOS Sonoma
- Guest: Windows, running in Parallels
- Tracing: Fiddler Everywhere / tcpdump, running on host MacOS
I'm trying to capture traffic from games running in my guest Windows machine, but I can't get it to work. I have setup a proxy setting in the Windows machine to point to the listening port of my Fiddler application; I can see most traffic just fine doing this. I suspect because the games are using libcurl or wget or something similar to make their https calls, and from what I understand these tools do not respect system proxy settings.
Example Tests
- Works: Open a browser in the Guest system, navigate to https://my.cool.app.com/ -- these connections show up in my Host system's Fiddler traces.
- Doesn't Work: Open a cmd terminal and
curl https://my.cool.app.com/-- these connections do not show up in my Host system's Fiddler traces; they do show up if I havetcpdumprunning in a shell on the Host sytem though. - Also Doesn't Work: If I set my Fiddler to "System Proxy", I expected it to show the connections from
curlsince it's supposed to intercept all traffic. This doesn't seem to be the case though.
Things I've Tried
- On the Guest Windows machine, I've tried setting
https_proxyenv vars to point to my Fiddler proxy endpoint. This... kind of works. I can at least see the connection attempts fromcurldoing this. However, a new problem arises when I try to run thecurlcommand I get the following error:
curl: (35) schannel: next InitializeSecurityContext failed: Unknown error (0x80092012) - The revocation function was unable to check revocation for the certificate.
- In Fiddler, I can see the initial
CONNECTattempt from thecurlbut nothing after that since the connection fails. - I have the
Fiddler_Root_Certificate_Authority.crtfrom Fiddler manually imported into the cert store on Windows, that was required to get any connections working. I'm not sure what other changes might be needed here though? This in particular is a bit outside my wheelhouse. - I've tried a few registry settings that I found on Google, with no noticeable change.
Goal
At the end of the day, all I really want to do is be able to see all traffic from my Parallels Guest system in my Fiddler captures. Since this is essentially a VM running on my local machine, I'd expect there to be something easy I haven't considered trying but I'm currently at a loss for what to try next?