network-recording

name	network-recording
description	Use when explicitly authorized lab traffic must be captured, searched, or exported from the project's mitmproxy-backed Docker lab recorder.

Network Recording

Use this skill only for an explicitly authorized Target and a network-enabled Docker lab. Recording is an observation capability: it does not expand target authorization, allowed methods, redirect scope, or the selected network profile.

Enable

Set the lab's Traffic recording option to mitmproxy (or set NETWORK_TRAFFIC_RECORDING_MODE=mitmproxy before the lab starts). The lab is recreated so its HTTP_PROXY, HTTPS_PROXY, and ALL_PROXY point to a per-project mitmproxy sidecar on 127.0.0.1:8080.

The recorder shares the lab's Docker network namespace (network_mode: service:lab is the Compose equivalent), so the existing egress firewall also constrains proxy-originated traffic. Its CA is trusted only inside that project lab. Recording cannot be enabled for offline labs.

Flows are retained in the project Docker volume as /captures/traffic.mitm inside the recorder. They can contain credentials, cookies, request bodies, and response bodies; treat them as sensitive evidence and redact before broader sharing.

Search flows

Run these commands from the recorder container, substituting its project-specific name from the lab boot log:

# Compact request/response index.
docker exec <recorder> mitmdump -nr /captures/traffic.mitm --set flow_detail=0

# Filter by host, method, status, or URL fragment.
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~d target.example'
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~m POST'
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~s 500'
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~u /api/'

# Search decoded request/response content deliberately; this may expose secrets.
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~q token'
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~b error'

Prefer narrow filters, record the exact command, target, time window, and result count in the evidence artifact. Stop capture when the approved observation is complete; stopping the lab stops its recorder but preserves the flow volume.