Recently I needed to do some analysis on FastCGI packets being sent to PHP-FPM.
Wireshark has a page on their wiki titled FastCGI which shows a screenshot of a pcap in Wireshark with detailed FastCGI info.
However, I couldn’t easily figure out from the wiki how to get the same details on my FastCGI pcap.
After reading, re-reading and clicking through Wireshark’s menus I was able to figure it out. Here’s what you need to do:
In my Wireshark installation this can be done by clicking “Enabled Protocols” under the “Analyze” menu.
Find “FCGI” and make sure it is checked.
For me this can be done by clicking “Preferences” under the “Wireshark” menu.
Expand the “Protocols” list and scroll down to FCGI. Then set the value to the port your FastCGI service was running on (in my case 9000).
Click “OK” and voila, your pcap should now show detailed FastCGI info.
Hi, I'm Max!
If you'd like to get in touch with me the best way is on Twitter.