Startup
Capture Summary
Device List
Device Detail
Web View
Request Detail
When Pixie is started, it shows a list of previous captures, as well as two buttons: one to start a "new capture", and then "quick network view". The latter simply listens on the network without saving data. You see the same statistics and live reports, but they are discarded as soon as the capture stops.
Selecting either "quick network view" or "new capture" will start Pixie listening on the wireless network.
You can also manage existing captures from this menu. Press and hold on a capture to open its context menu. You have three options for an existing capture:
- Replay: the capture is played back again through Pixie, allowing you to see statistcal data and web requests.
- Share: the capture is zipped up and emailed to the recipient of your choice for off-line analysis.
- Delete: the capture is deleted from your phone.
Tapping "new capture" or "quick network view" activates Pixie and opens the Summary screen. This screen shows basic summary information about the network. To stop the capture, use the phone's Back button from this screen or tap "Stop Capture".
Some of the more interesting statistics shown are:
- Devices: how many total devices Pixie has heard on the network.
- Usage: current network bandwidth, updated every few seconds. This is an approximation based on what Pixie can hear.
- TCP: how many total TCP packets Pixie has seen. Most common Internet protocols run on TCP, such as web browsing, email, instant messenger clients, etc. If a number appears in parentheses, that indicates how many web requests Pixie has seen as well.
- UDP: how many total UDP packets Pixie has seen. Protocols such as BitTorrent and Skype use UDP primarily.
- Other: how many other packets Pixie has seen (non-IP or IP packets other than TCP and UDP).
Click on the "Devices" button to see a list of the devices that Pixie has seen on the network. Each device is shown with its hardware (MAC) address, manufacturer, and some basic statistics.
Each device's current estimated usage appears, along with the TCP (and web) statistic.
Note that the manufacturer is typically who manufactured the network adapter. This may or may not be the company who actually built the whole device. For example, in this screenshot, the "Hon Hai Precision" device with so much activity is actually a Dell XPS laptop that happens to contain an HHPD network adapter.
Click on a device to view its Device Detail screen. This screen displays traffic statistics for the single device, including a guess at its internal IP address.
In addition, any web requests made from the device will appear in a scrolling region. See the next section for tips on interacting with the list of web requests.
From the Capture Summary screen, click the "Web" button to view a list of all web requests from Pixie. This display is very similar to the Device Detail list of web requests, but it contains all web requests. Each request seen includes the last three digits of the requesting device to help readability.
Most web requests will appear in white. Press and hold to open the context menu for a request, allowing you to browse to the URL that was requested or, from the Web screen, open up the Device Detail for the requesting device.
If the request contained a query string, it will appear in a pale yellow color. You can tap the request (or select "View Request Detail" from context) to see the query string parsed for you.
If the request contained a form submission, it will be rendered in a darker orange color. You can tap the request (or select "View Request Detail" from context) to see the data that was sent with the request. Note that some applications will post data in a proprietary format. This data will not be visible in Pixie, but can be examined off-line.
When viewing a request detail, Pixie will show the device information and the URL that was requested from the remote server. If the request contained POST data, Pixie will also include all of the information sent up by the device. This will comprise the whole HTTP request, such as referring data and cookies.
Google keyword search |
Form request with POST data |
A brief note on the example POST data above: this is a submission of the CNN.com member signup form. We intentionally failed the CAPTCHA test to prevent an account from being created.
Even cursory examination of the cookies above shows that CNN collects your ISP and type of network connection during this process (look for "cable&cox.net" in cookie data, we didn't enter that on the form). Pixie is incredibly useful for finding information like this from various sites on the Internet.