Trace Chromium Network Traffic: RayFo/Chromium by rayfo · Pull Request #52 · microsoft/MSO-Scripts

R Fowkes (rayfo) · 2026-07-30T05:08:15Z

Trace Chromium Network Traffic: Chrome, Edge, WebView2 browsers

This commit adds the "Chromium" protocol class to the main NetBlame data table (in addition to WinINet, WinHTTP, Winsock, TcpIp).
It also adds a new Chromium-specific table: "NetBlame Chromium Requests"
In the DEBUG build (enable AUX_TABLES) there is also a table oriented around HTTP2/3 Streams.

It enables these Providers for Chrome, Edge, WebView2:

{d2d578d9-2936-45b6-a09f-30e32715f42d} : Google.Chrome
{3A5F2396-5C8F-4F1F-9B67-6CCA6C990E61} : Microsoft.MSEdgeStable
{BD089BAA-4E52-4794-A887-9E96868570D2} : Microsoft.MSEdgeBeta
{C56B8664-45C5-4E65-B3C7-A8D6BD3F2E67} : Microsoft.MSEdgeCanary
{D30B5C9F-B58F-4DC9-AFAF-134405D72107} : Microsoft.MSEdgeDev
{E16EC3D2-BB0F-4E8F-BDB8-DE0BEA82DC3D} : Microsoft.MSEdgeWebView2

Update NetBlame Add-in
Add Chromium ETW processing:
.\src\netblame\providers\chromium.cs
.\src\netblame\gathertables.cs
.\src\netblame\tables\netblametable.url.cs
.\src\netblame\netblamedataprocessor.cs
.\src\netblame\auxiliary\callstack.cs
.\src\netblame\auxiliary\extensions.cs
.\src\netblame\auxiliary\netutil.cs
Minor Update:
.\src\netblame\providers\dnsclient.cs
.\src\netblame\providers\winsockafd.cs
Nits:
.\src\netblame\providers\tcpip.cs
.\src\netblame\tables\netblametable.webio.request.cs
.\src\netblame\tables\netblametable.winsock.cs
.\src\netblame\tables\tablebase.cs

Update Scripts
PowerShell:
.\src\tracenetwork.ps1
.\src\beta\tracenetwork.ps1
WPR Profiles:
.\src\wprp\edgechrome.15002.wprp
.\src\wprp\edgechrome.wprp
Comments for Build:
.\src\netblame\.editorconfig

BUILD
RELEASE: dotnet build -c RELEASE
DEBUG: dotnet build -c DEBUG -p AUX_TABLES=1

TEST
Capture a trace:
.\src\TraceNetwork Start
Launch Edge or Chrome and navigate to a site.
.\src\TraceNetwork Stop

The script knows how to pick up the built version of the NetBlame add-in:
.\src\BETA\TraceNetwork View -fastsym -verbose

This update resolves #50
Chromium Integration into NetBlame WPA Network Plug-in

…RayFo/Chromium

…into RayFo/Chromium

R Fowkes (rayfo) · 2026-07-30T05:09:22Z

Harold Pratt (@htpiv) Rob Grimes (@rgrimes-ms) Can you please take a look and approve the pull to main?

I'll update the documentation once there's a new build.
Chromium Network Tracing

Thank you!

R Fowkes (rayfo) · 2026-07-30T21:10:54Z

FYI, WPA (x64 or ARM64) loads these modules as provided by the NETBLAME installation.
We should make sure that the auto-build includes at least these:

	\BETA\ADDIN\NetBlameAddIn.dll
	
	\BETA\ADDIN\Dia2Lib.dll
	\BETA\ADDIN\Microsoft.Diagnostics.FastSerialization.dll
	\BETA\ADDIN\Microsoft.Diagnostics.NETCore.Client.dll
	\BETA\ADDIN\Microsoft.Diagnostics.Tracing.TraceEvent.dll
	\BETA\ADDIN\Microsoft.Extensions.DependencyInjection.Abstractions.dll
	\BETA\ADDIN\Microsoft.Extensions.DependencyInjection.dll
	\BETA\ADDIN\Microsoft.Extensions.Logging.Abstractions.dll
	\BETA\ADDIN\Microsoft.Extensions.Logging.dll
	\BETA\ADDIN\Microsoft.Extensions.Options.dll
	\BETA\ADDIN\Microsoft.Extensions.Primitives.dll
	\BETA\ADDIN\Microsoft.Windows.EventTracing.Events.dll
	\BETA\ADDIN\Microsoft.Windows.EventTracing.Metadata.dll
	\BETA\ADDIN\Microsoft.Windows.EventTracing.Processes.dll
	\BETA\ADDIN\Microsoft.Windows.EventTracing.Processing.dll
	\BETA\ADDIN\System.Collections.Immutable.dll
	\BETA\ADDIN\System.Reflection.Metadata.dll
	\BETA\ADDIN\System.Text.Encodings.Web.dll
	\BETA\ADDIN\System.Text.Json.dll
	\BETA\ADDIN\TraceReloggerLib.dll

	\BETA\ADDIN\x64\wpt\msdia140.dll
	\BETA\ADDIN\x64\wpt\perf_dynamic.dll
	\BETA\ADDIN\x64\wpt\perf_nt.dll
	\BETA\ADDIN\x64\wpt\perfcore.dll
	\BETA\ADDIN\x64\wpt\symcache.dll
	\BETA\ADDIN\x64\wpt\symsrv.dll

	\BETA\ADDIN\arm64\wpt\msdia140.dll
	\BETA\ADDIN\arm64\wpt\perf_dynamic.dll
	\BETA\ADDIN\arm64\wpt\perf_nt.dll
	\BETA\ADDIN\arm64\wpt\perfcore.dll
	\BETA\ADDIN\arm64\wpt\symcache.dll
	\BETA\ADDIN\arm64\wpt\symsrv.dll

R Fowkes (rayfo) · 2026-08-18T02:20:31Z

Quick Steps to Download, Build, and Run this version/PR via PowerShell:

Download and unzip the Source Code:
- Invoke-WebRequest -uri "https://github.com/microsoft/MSO-Scripts/archive/refs/pull/52/merge.zip" -outfile "$Env:TEMP\Pull52.zip"
- Expand-Archive -path "$Env:TEMP\Pull52.zip" -destinationpath "$Env:TEMP"
- mv "$Env:TEMP\MSO-Scripts-refs-pull-52-merge\" "c:\MSO-Scripts\"
If needed, install DotNet (v8, 9, or 10) (only required when building the 'NetBlame' WPA Plug-In locally):
- winget install --id Microsoft.DotNet.Runtime.10
- winget install --id Microsoft.DotNet.SDK.10
Build the WPA Plug-in:
- cd "c:\MSO-Scripts\src\NetBlame"
- & $Env:ProgramFiles\dotnet\dotnet build -c Release
Collect a Network Trace (requires Administrator privilege):
- cd "c:\MSO-Scripts\src"
- .\BETA\TraceNetwork.bat Start
- Launch Chrome or Edge and visit a site.
- .\BETA\TraceNetwork.bat Stop
If needed, download the Windows Performance Analyzer (WPA)
Launch the Viewer:
- .\BETA\TraceNetwork.bat View
- Within WPA: New Tab
- Within WPA's Graph Explorer (Ctrl-G): Network > dbl-click: NetBlame Chromium Requests

Deleted user (ghost) · 2026-08-21T00:33:09Z

 		public ODispatchQTable odqTable;
 		public IdleManTable idleTable;
 		public ThreadTable threadTable;
+		public ChromiumTable chromiumTable;


Do we need to account for this new table in EventCount()?

Hmm... Yes, ideally EventCount (in NetBlameDataProcessor.cs) should add:
+ this.chromiumTable.Count
Because if EventCount()==0 then NetBlame will return: "No Data"

As a practical matter, when there are Chromium events there will be TCP events, so: EventCount()!=0

For the main NetBlame view, Chromium events link to WinSock events, which link to TCP events. But such links to lower-level transport activity are not required for showing Chromium activity.

Deleted user (ghost) · 2026-08-21T00:59:53Z

+				AssertInfo(session != null);
+				if (session == null)
+				{
+					session = new Session(StreamType.QUIC, in evt);


This handler is processing HTTP2_SESSION_SEND_DATA and HTTP2_SESSION_RECV_DATA , but the recovery path creates a QUIC session. If tracing starts after the original HTTP/2 session-creation event, this can classify HTTP/2 traffic as HTTP/3 and split subsequent events across different sessions. Should this be StreamType.HTTP2, matching the surrounding HTTP/2 recovery paths?

Good catch:
session = new Session(StreamType.HTTP2, in evt);

Deleted user (ghost) · 2026-08-21T01:05:29Z

+		{
+			IPEndPoint addrRemote;
+			if (this.socket == null && this.resolver?.rgstrAddress?.Length > 0)
+				addrRemote = new(IPAddress.Parse(this.resolver.rgstrAddress[0]), this.port);


Use TryParse or a helper to avoid aborting on a throw?

Yeah, to be really defensive it should use: IPAddress.TryParse

if (this.socket == null && this.resolver?.rgstrAddress?.Length > 0 && IPAddress.TryParse(this.resolver.rgstrAddress[0], out IPAddress addrParse)) addrRemote = new(addrParse, this.port);

Deleted user (ghost) · 2026-08-21T01:06:28Z

+				stream = session.EnsureStream(iStream, evt.Timestamp.ToGraphable());
+
+				if (evt.TaskName.Equals("HTTP3_DATA_SENT"))
+					stream.cbSend = cb;


stream.cbSend += cb ?

Same question on line 4554

Preliminary assessment: Yes, use: +=

R Fowkes (rayfo) · 2026-08-24T21:23:18Z

src\netblame\providers\winsockafd.cs Connection Clone()
cxn.iDNS = 0;
We clone a Winsock Connection and give it a different remote address. But we also need to zero its iDNS, which indexes the DNS record which contains that address. (When cxn.iDNS==0, it gets updated later.)

src\netblame\gathertables.cs
src\netblame\providers\dnsclient.cs IFindAddress()
int iAddr = dnsE.rgIpAddr.IndexOf(ipAddr);
Simplify IFindAddress, which is now invoked from only one place. Fail if the address is not found in the indexed DNS record, which should not happen [see above].

src\netblame\providers\tcpip.cs FMatch()
if (this.FClosed) return false;
Each WinSock Connection should link with a TCP or UDP object. We were getting inconsistencies because FMatch was considering UDP connections already closed.

Ricardo Esquivel (richybourne)

Resubmitting "request changes" PR review on GH account with access to repo.

Raymond Fowkes and others added 6 commits December 5, 2025 15:15

Capture the Chromium DNS Info

20e3527

NetBlame Chromium Processing

9cbc6b8

NetBlame Chromium Processing

e4e4e46

Merge branch 'main' of https://github.com/microsoft/MSO-Scripts into …

4c5b164

…RayFo/Chromium

Merge branch 'microsoft:main' into RayFo/Chromium

c33a132

Merge branch 'RayFo/Chromium' of https://github.com/rayfo/MSO-Scripts …

e44aeb8

…into RayFo/Chromium

Deleted user (ghost) reviewed Aug 21, 2026

View reviewed changes

Deleted user (ghost) suggested changes Aug 21, 2026

View reviewed changes

Ricardo Esquivel (richybourne) requested changes Aug 25, 2026

View reviewed changes

Uh oh!

Conversation

R Fowkes (rayfo) commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

R Fowkes (rayfo) commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

R Fowkes (rayfo) commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

R Fowkes (rayfo) commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Quick Steps to Download, Build, and Run this version/PR via PowerShell:

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

R Fowkes (rayfo) commented Aug 24, 2026

Uh oh!

Ricardo Esquivel (richybourne) left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

R Fowkes (rayfo) commented Jul 30, 2026 •

edited

Loading

R Fowkes (rayfo) commented Jul 30, 2026 •

edited

Loading

R Fowkes (rayfo) commented Jul 30, 2026 •

edited

Loading

R Fowkes (rayfo) commented Aug 18, 2026 •

edited

Loading